Kata guest escape: runtime-rs guest-root to host-root escape via virtiofs
Date: 2026-05
Affected: go/github.com/kata-containers/kata-containers
Attack vector: rce
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2026-44210
CVE-2026-47243
CWE: CWE-22
CWE-36
CWE-88

### Summary In the runtime-rs standalone virtio-fs path, verified here with QEMU (and verified with Cloud Hypervisor too), Kata Containers runs host `virtiofsd` as root with: ``` --sandbox none --seccomp none ``` If an attacker has root-equivalent execution inside the Kata guest VM, they can send raw FUSE requests directly to the host `virtiofsd`. With the tested runtime-rs virtio-fs configuration, a raw `FUSE_SYMLINK` request whose new symlink name is an absolute host path is honored outside the virtio-fs shared directory. This lets guest root create host-root owned symlinks in sensitive host paths. The PoC created here will create symlinks in the host `/etc/cron.d` directory, causing host cron to execute a guest-controlled payload as host root. Impact: guest root can execute code as host root. ### Affected configuration The verified host used: ``` /opt/kata/share/defaults/kata-containers/runtime-rs/configuration-qemu-runtime-rs.toml rootless = false shared_fs = "virtio-fs" virtio_fs_daemon = "/opt/kata/libexec/virtiofsd" hypervisor_name = "qemu" debug_console_enabled = false ``` Pinned upstream references, using Kata Containers `main` commit `2ffd1538a296cff93a357bfba0dfca747480a1f8`: - runtime-rs standalone virtio-fs adds [`--sandbox none --seccomp none`](https://github.com/kata-containers/kata-containers/blob/2ffd1538a296cff93a357bfba0dfca747480a1f8/src/runtime-rs/crates/resource/src/share_fs/share_virtio_fs_standalone.rs#L82-L92) to the `virtiofsd` command lin


Mitigations:

Architectural layers (MAESTRO):