Copyright © 2012 Red Hat, Inc. All rights reserved. Low 2026-06-25T00:00:00 kubevirt: virt-handler-rhel9: kubevirt: unbounded virtio-serial ReadLine in virt-handler causes OOM denial of service 3.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L CWE-770

A flaw was found in KubeVirt's downward metrics virtio-serial server. The server reads guest requests using textproto.Reader.ReadLine(), which buffers input indefinitely until a newline character is received, with no length limit or read deadline. A user with access to a VM guest that has the downward metrics virtio-serial device configured can write a continuous byte stream to the device, causing unbounded memory allocation in the virt-handler process until it is OOM-killed.

A flaw was found in KubeVirt's downward metrics virtio-serial server. The server reads guest requests using textproto.Reader.ReadLine(), which buffers input indefinitely until a newline character is received, with no length limit or read deadline. A user with access to a VM guest that has the downward metrics virtio-serial device configured can write a continuous byte stream to the device, causing unbounded memory allocation in the virt-handler process until it is OOM-killed.

Red Hat has rated this issue as having Low security impact. The vulnerable code runs in virt-handler, a node-level DaemonSet; however, in OpenShift Virtualization, cgroup memory limits ensure the OOM kill is contained to the virt-handler pod and does not affect the node kernel or kubelet. Running VM workloads (QEMU processes) survive independently and continue operating — only management operations (live migration, graceful shutdown, monitoring updates) are temporarily disrupted. An administrator can recover by deleting the offending VirtualMachineInstance, after which virt-handler resumes normal operation on its next restart. The attack surface is limited to VMIs that explicitly configure a downwardMetrics virtio-serial device, which is not part of the default VM configuration. The blast radius is confined to a single node. This issue was discovered by Huzaifa Sidhpurwala (Red Hat). The downward metrics virtio-serial device must be explicitly added to a VM's specification to be present. Clusters that do not use this feature are not exposed. To reduce exposure, administrators can restrict the ability to configure downward metrics devices on tenant VMs by using an admission webhook or policy controller such as Gatekeeper/OPA. Red Hat OpenShift Virtualization 4 Fix deferred container-native-virtualization/virt-handler Red Hat OpenShift Virtualization 4 Fix deferred container-native-virtualization/virt-handler-rhel9 https://www.cve.org/CVERecord?id=CVE-2026-13322 https://nvd.nist.gov/vuln/detail/CVE-2026-13322