# CVE-2026-13201: kubevirt: This update for kubevirt fixes the following issues:  - Security update correcting a CVE over-claim from the previous...

CVE-2026-13201 is fixed in 3 products on 1 platform, first by SUSE-SU-2026:3480-1, released August 4, 2026. It is not reported as exploited. Patch Radar priority: Routine.

- Web page: https://patchblox.com/security/cve/CVE-2026-13201
- Priority: Routine
- CVSS: n/a
- EPSS: 0.0031
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Aug 4, 2026

## Description

This update for kubevirt fixes the following issues:  - Security update correcting a CVE over-claim from the previous   update, verified by auditing the fix code actually present in the   vendored tree:    * CVE-2026-39821 (bsc#1266575): the previous entry claimed this     fixed by the golang.org/x/net v0.55.0 re-vendor, but 0.55.0's     idna fix is compile-time gated on Unicode 16 tables, which only     exist for go1.27+ - it is inert in our go1.25 builds, so the     claim was incorrect. Re-vendor golang.org/x/net v0.55.0 ->     v0.57.0, whose idna package rejects all-ASCII Punycode labels     unconditionally; the CVE is now actually fixed.  - Re-vendor golang.org/x/text v0.37.0 -> v0.40.0: CVE-2026-56852   (bsc#1271661), infinite loop on invalid input in unicode/norm.  - golang.org/x/crypto v0.52.0 -> v0.54.0 (pulled in by x/net 0.57.0;   no additional CVE claims, all previously listed x/crypto fixes   remain included).  - CVE-2026-13201 (bsc#1269093), safepath resolves a path whose last   component is a symlink without detecting it, allowing metadata   operations via /proc/self/fd to act on the symlink target.   Backports of upstream release-1.7 commits 9ecda4ad5e and   1494cee849. - x/net 0.57.0 also contains the fix for CVE-2026-46600   (bsc#1272415) in dns/dnsmessage; kubevirt does not vendor that   package (not affected), the bump merely rides past it.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | kubevirt sles 15.7 | 1.7.4-150700.3.33.1 | [SUSE-SU-2026:3480-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-3480-1.md) | Aug 4, 2026 |
| Linux | kubevirt-1.6 sles 15.7 | 1.6.6-150700.15.17.1 | [SUSE-SU-2026:3630-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-3630-1.md) | Aug 17, 2026 |
| Linux | kubevirt1.8 opensuse-leap 16.0 | 1.8.4-160000.1.1 | [OPENSUSE-SU-2026:21590-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-21590-1.md) | Aug 18, 2026 |

---

Data as of 2026-11-10T07:50:38Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.