QEMU guest agent plugs root escalation in SSH key commands

A local privilege-escalation bug in the QEMU guest agent let an unprivileged user obtain root when the host or an operator added SSH keys for that account.

Tracked as CVE-2026-12080, the flaw sat in the guest-ssh commands that manage a user's authorized_keys file. The agent runs as root. It previously decided whether to create the target user's .ssh directory with a check that followed symbolic links, then wrote the keys file and changed its ownership. A user who already owned their home directory could pre-stage .ssh or authorized_keys as a symlink pointing at a root-owned path. When the agent ran, it followed the link and handed ownership of that path to the unprivileged user, who could then rewrite it and escalate to root.

Kostiantyn Kostiuk of Red Hat fixed the issue by switching the agent's effective user and group IDs to the target account before touching the filesystem, so the operations run with the user's own privileges instead of root performing a later chown. The problem was reported by Valentino Paulon.

The commands are a common way for hypervisors and management tools to inject SSH access into guests, so any environment that exposes them to untrusted local accounts inside the guest was exposed.