CVE-2026-13322: KubeVirt Downward Metrics Memory Exhaustion (CWE-770)

Technical summary

The vulnerability stems from KubeVirt's use of textproto.Reader.ReadLine() in its downward metrics virtio-serial server implementation. This function buffers incoming data until a newline character arrives, but the code lacks input length limits and read timeouts. An authenticated guest can exploit this by sending a continuous byte stream, causing the virt-handler process to allocate memory indefinitely until an out-of-memory (OOM) condition terminates the process. The root cause is classified under CWE-770 (Allocation of Resources Without Limits or Throttling).

Business impact

This vulnerability can disrupt virtualized workloads by causing virt-handler crashes, leading to service unavailability for affected VMs and potential cascading failures in OpenShift Virtualization clusters. Organizations relying on KubeVirt for production workloads may experience pod evictions, failovers, and operational overhead. The impact is contained to denial-of-service scope—no data exposure or integrity compromise occurs—but reliability is compromised in multi-tenant or high-density virtualization environments.

Affected systems

The vulnerability affects KubeVirt (all versions with the downward metrics virtio-serial server enabled) and Red Hat OpenShift Virtualization, which bundles KubeVirt. The attack vector requires local access to a guest VM and requires that the downward metrics device be explicitly configured on that VM. Environments without this device enabled, or air-gapped VM deployments, have reduced risk exposure.

Exploitability

Exploitability is relatively constrained due to multiple preconditions: an attacker must already have access to a guest VM (local privilege level), and the downward metrics virtio-serial device must be configured. No network access is required, and no special tools or techniques are needed—writing continuous data to a character device is straightforward. The CVSS 3.1 score of 3.8 (LOW) reflects these barriers but acknowledges that insider threats or compromised workloads can trigger the flaw.

Remediation

Patch KubeVirt to a version that implements input length limits and read timeouts in the virtio-serial server's ReadLine() logic. Verify the specific patched version against the official KubeVirt security advisory. As interim mitigation, disable the downward metrics virtio-serial device on VMs that do not require it, restrict VM access to trusted users, and monitor virt-handler process memory and OOM events. Network segmentation and pod security policies should be used to limit guest-to-host attack surface.

Patch guidance

Contact your KubeVirt and Red Hat OpenShift Virtualization vendors for official patch releases. Patch availability and version numbers should be verified directly from the KubeVirt project repository and Red Hat security advisories. Test patches in a staging environment before production deployment, paying attention to any behavioral changes in metrics collection or virtio-serial communication. Plan maintenance windows to update virt-handler components across your cluster with minimal guest disruption.

Detection guidance

Monitor virt-handler process memory usage patterns for unexpected growth correlated with guest activity on systems where downward metrics are enabled. Enable kernel audit logging or container runtime monitoring to detect excessive or sustained writes to virtio-serial device paths (/dev/virtio-ports/com.redhat.spice.0 or similar). Kubernetes node metrics and Prometheus scraping can expose anomalous memory pressure on nodes hosting affected VMs. Establish baseline memory profiles and alert on sustained deviations indicating potential exploitation attempts.

Why prioritize this

Despite the LOW CVSS score, prioritize this vulnerability in environments running multi-tenant or semi-trusted virtualization workloads. The flaw is easily triggered by any guest user once VM access is obtained, and can cause operational disruption in production clusters. Organizations with strong VM access controls and no reliance on downward metrics can safely deprioritize, but those with permissive guest policies or shared VM pools should address it promptly to prevent denial-of-service scenarios.

Risk score, explained

The CVSS 3.1 score of 3.8 reflects a LOW severity due to the local attack vector (AV:L), low complexity (AC:L), and requirement for existing user privileges (PR:L). The impact is limited to availability (A:L), with no confidentiality or integrity loss. The scope changes the context (S:C), but the overall severity remains low because exploitation requires prior VM access and does not escalate privilege or leak sensitive data. In high-availability or critical infrastructure deployments, real-world risk may exceed the numerical score.

Frequently asked questions