CVE-2026-88265
MediumCVSS 5.6Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
A flaw was found in crun. After pivot_root, reopening /dev/null for stdio can follow a symlink and attach a host file to container stdio, then change that file's ownership. Affected versions are crun 1.29.1 and earlier. Default configurations that mount a fresh /dev are not exposed. No fixed release is available yet.
Risk Assessment
A container may access host files and change their ownership, potentially leading to privilege escalation or modification of system files. Configurations without a dedicated /dev mount are exposed.
Recommendation
Ensure container configuration mounts a fresh /dev to avoid exposure. Monitor crun releases for a version fixing this vulnerability.
Other vulnerabilities in crun
See all- CVE-2026-88264Medium
A flaw was found in crun. When the container configuration does not give /dev a dedicated mount, terminal setup can redirect /dev/console onto an attacker-controlled path, including via the read-only-rootfs bind-mount fallback. Affected versions are crun 1.29.1 and earlier. Default configurations that mount a fresh /dev are not exposed. No fixed release is available yet.
- CVE-2026-84042High
In crun, when built with libkrun and a container is started rootful with passt networking (krun.use_passt), crun can execute attacker-controlled payload from the container image with host root privileges. This is a regression in crun 1.29 and affects crun >= 1.29.
- CVE-2026-47766Medium
crun before version 1.28 contains a vulnerability in the default device setup that opens the container rootfs `/dev` directory without `O_NOFOLLOW`. If an OCI bundle contains `rootfs/dev` as a symlink and the bundle configuration does not mount `/dev`, crun follows that symlink and creates default device nodes and stdio symlinks at the symlink target outside the container rootfs. This can lead to overwriting existing files, such as ptmx.
Original NVD description (English source)
A flaw was found in crun. After pivot_root, reopening /dev/null for stdio can follow a symlink and attach a host file to container stdio, then change that file's ownership. Affected versions are crun 1.29.1 and earlier. Default configurations that mount a fresh /dev are not exposed. No fixed release is available yet.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS