CVE-2026-64676
Description
A flaw was found in Kata Containers. When the mem-agent feature is enabled, an untrusted host can bypass authorization checks in the kata-agent's memory management. This allows the host to tamper with in-guest memory, leading to attacker-controlled availability and performance degradation of confidential workloads.
Statement
A flaw was found in Kata Containers when the mem-agent feature is explicitly enabled (off by default). An untrusted host can bypass authorization checks in the kata-agent's memory management for confidential guests. This allows the host to tamper with in-guest memory management operations (forcing swap, eviction, or compaction), leading to performance degradation of confidential workloads. The impact is limited to availability and performance - this vulnerability does not allow code execution or memory disclosure. The vulnerability only affects deployments where the mem-agent feature has been explicitly enabled via agent.mem_agent_enable=1 configuration.
Mitigation
The mem-agent feature is disabled by default. Do not enable mem-agent (agent.mem_agent_enable=1) unless required. If mem-agent is needed, upgrade to kata-containers 4.0.0 or later.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.9 | N/A | 5.7 |
| Attack Vector | Local | N/A | Local |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Changed | N/A | Changed |
| Confidentiality | None | N/A | None |
| Integrity Impact | Low | N/A | Low |
| Availability Impact | High | N/A | Low |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:H
cve.org: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L
Understanding the Weakness (CWE)
Confidentiality,Integrity,Availability,Access Control
Technical Impact: Read Application Data; Modify Application Data; Execute Unauthorized Code or Commands; Gain Privileges or Assume Identity
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
