Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
KubeVirt can crash and stop virtual machines
published 1 month ago
Summary
In KubeVirt version 1.8.4-2, a user who can create virtual machines can submit a badly formed definition that causes the management service to crash repeatedly. This stops the system from starting, stopping, or managing any virtual machines until the problem is fixed. Update KubeVirt to a newer release or remove the faulty definitions to restore normal operation.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Azure Linux:3 | azure | kubevirt | <= 1.8.4-2 |
Original advisory text
CVE-2026-102623 affecting package kubevirt 1.8.4-2
A flaw was found in KubeVirt. An authenticated user with permission to create Virtual Machine Instances (VMIs) can cause a Denial of Service (DoS) by submitting a virtual machine definition with an empty ephemeral volume. The virt-controller component fails to properly validate the volume configuration, leading to an unhandled exception and application crash during processing. Because the malformed definition persists in the cluster, the controller enters a continuous crash loop, disrupting virtual machine lifecycle operations across the entire environment.
References
Timeline
Published29 Sep 2026
Updated3 Oct 2026
First seen3 Oct 2026
Sources
AZL-105537 · OSV
Track software like this
Free during beta