CVE-2026-41579
Fixed in a distro release EPSS <1%CVSS 3.3
runc is a CLI tool for spawning and running containers according to the OCI specification. In versions prior to 1.3.6, 1.4.0-rc.1, 1.4.0-rc.12, 1.5.0-rc.1, and 1.5.0-rc.1, when setting up the container rootfs, setupPtmx and setupDevSymlinks call os.Remove and os.Symlink with a filepath.Join string which allow an image with /dev as a symlink to trick runc into deleting files called ptmx on the host or creating a hardcoded set of symlinks with specific names and targets in an arbitrary pre-existing host directory. This issue is not exploitable under Docker, because Docker creates a top-level read-only layer that masks any malicious /dev symlink present in the container image — unlike some other Linux container tooling, whose higher-level runtimes built on runc remain exposed to exploitation via a malicious image. This issue has been fixed in versions 1.3.6, 1.4.3 and 1.5.0.
Products: opencontainers runc
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | github.com/opencontainers/runc | 1.3.6 |
| Go | github.com/opencontainers/runc | 1.4.3 |
| Go | github.com/opencontainers/runc | 1.5.0-rc.3 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux 2023 | runc | 1.3.6-1.amzn2023.0.1 |
| Chainguard | buildah | 1.44.0-r6 |
| Chainguard | buildah-fips | 1.44.0-r3 |
| Chainguard | cadvisor | 0.60.2-r1 |
| Chainguard | cadvisor-compat | 0.60.5-r8 |
| Chainguard | cadvisor-fips | 0.60.2-r1 |
| Chainguard | ctop | 0 |
| Chainguard | ctop-fips | 0 |
| Chainguard | docker-machine-driver-harvester | 1.1.0-r1 |
| Chainguard | eks-distro-kube-apiserver-1.31 | 0 |
| Chainguard | eks-distro-kube-apiserver-fips-1.31 | 0 |
| Chainguard | eks-distro-kube-controller-manager-1.30 | no fix |
| Chainguard | eks-distro-kube-controller-manager-1.31 | 0 |
| Chainguard | eks-distro-kube-controller-manager-1.32 | 0 |
| Chainguard | eks-distro-kube-controller-manager-fips-1.30 | no fix |
| Chainguard | eks-distro-kube-controller-manager-fips-1.31 | 0 |
| Chainguard | eks-distro-kube-controller-manager-fips-1.32 | 0 |
| Chainguard | eks-distro-kube-proxy-1.30 | no fix |
| Chainguard | eks-distro-kube-proxy-1.31 | 0 |
| Chainguard | eks-distro-kube-proxy-1.32 | 0 |
| Chainguard | eks-distro-kube-proxy-fips-1.30 | no fix |
| Chainguard | eks-distro-kube-proxy-fips-1.31 | 0 |
| Chainguard | eks-distro-kube-proxy-fips-1.32 | 0 |
| Chainguard | eks-distro-kube-scheduler-1.31 | 0 |
| Chainguard | eks-distro-kube-scheduler-fips-1.31 | 0 |
| Chainguard | falco-no-driver | 0.45.0-r0 |
| Chainguard | gosu-1.11 | no fix |
| Chainguard | gpu-operator-26.3-validator | 26.3.3-r1 |
| Chainguard | gpu-operator-fips-26.3-validator | 26.3.2-r2 |
| Chainguard | harvester | no fix |
| Chainguard | harvester-fips | no fix |
| Chainguard | harvester-fips-upgrade-helper | no fix |
| Chainguard | harvester-fips-webhook | no fix |
| Chainguard | harvester-upgrade-helper | no fix |
| Chainguard | harvester-webhook | no fix |
| Chainguard | k3s-1.32 | no fix |
| Chainguard | k3s-1.33 | no fix |
| Chainguard | k3s-static-1.32 | no fix |
| Chainguard | k3s-static-1.33 | no fix |
| Chainguard | kube-conformance-1.32 | no fix |
| Chainguard | kube-controller-manager-1.32 | no fix |
| Chainguard | kube-controller-manager-fips-1.32 | no fix |
| Chainguard | kube-proxy-1.32 | no fix |
| Chainguard | kube-proxy-fips-1.32 | no fix |
| Chainguard | kubelet-1.32 | no fix |
| Chainguard | kubelet-fips-1.32 | no fix |
| Chainguard | kubernetes-1.32 | no fix |
| Chainguard | kubernetes-fips-1.32 | no fix |
| Chainguard | mps-control-daemon | 0.20.0-r4 |
| Chainguard | node-feature-discovery-0.17 | 0 |
| Chainguard | node-feature-discovery-0.18 | 0.18.3-r19 |
| Chainguard | node-feature-discovery-fips-0.17-worker | 0 |
| Chainguard | node-feature-discovery-fips-0.18-worker | 0.18.3-r18 |
| Chainguard | nvidia-container-toolkit-fips-nvidia-cdi-hook | 1.19.1-r3 |
| Chainguard | nvidia-container-toolkit-fips-nvidia-container-runtime | 1.19.1-r3 |
| Chainguard | nvidia-container-toolkit-fips-nvidia-container-runtime-cdi | 1.19.1-r3 |
| Chainguard | nvidia-container-toolkit-fips-nvidia-container-runtime-hook | 1.19.1-r3 |
| Chainguard | nvidia-container-toolkit-fips-nvidia-container-runtime-legacy | 1.19.1-r3 |
| Chainguard | nvidia-container-toolkit-fips-nvidia-ctk | 1.19.1-r3 |
| Chainguard | nvidia-container-toolkit-fips-nvidia-ctk-installer | 1.19.1-r3 |
| Chainguard | nvidia-container-toolkit-nvidia-cdi-hook | 1.19.1-r4 |
| Chainguard | nvidia-container-toolkit-nvidia-container-runtime | 1.19.1-r4 |
| Chainguard | nvidia-container-toolkit-nvidia-container-runtime-cdi | 1.19.1-r4 |
| Chainguard | nvidia-container-toolkit-nvidia-container-runtime-hook | 1.19.1-r4 |
| Chainguard | nvidia-container-toolkit-nvidia-container-runtime-legacy | 1.19.1-r4 |
| Chainguard | nvidia-container-toolkit-nvidia-ctk | 1.19.1-r4 |
| Chainguard | nvidia-container-toolkit-nvidia-ctk-installer | 1.19.1-r4 |
| Chainguard | nvidia-device-plugin | 0.19.3-r1 |
| Chainguard | nvidia-device-plugin-fips | 0.19.3-r1 |
| Chainguard | podman | 6.0.0-r0 |
| Chainguard | podman | 6.0.0-r3 |
| Chainguard | podman-fips | 5.8.3-r1 |
| Chainguard | podman-fips-6.0 | 6.0.0-r3 |
| Chainguard | prometheus-podman-exporter | 1.21.1-r2 |
| Chainguard | prometheus-podman-exporter-fips | 1.21.2-r1 |
| Chainguard | rancher-2.10 | no fix |
| Chainguard | rancher-2.11 | 2.11.14-r2 |
| Chainguard | rancher-agent-2.10 | no fix |
| Chainguard | rancher-agent-2.11 | 2.11.14-r3 |
| Chainguard | rancher-agent-2.9 | no fix |
| Chainguard | rke2-runtime-1.32 | no fix |
| Chainguard | rke2-runtime-fips-1.32 | no fix |
| Chainguard | rke2-runtime-fips-kube-controller-manager-1.32 | no fix |
| Chainguard | rke2-runtime-fips-kube-proxy-1.32 | no fix |
| Chainguard | rke2-runtime-fips-kubelet-1.32 | no fix |
| Chainguard | sriov-network-device-plugin | 3.11.0-r16 |
| Chainguard | sriov-network-device-plugin-fips | 3.11.0-r13 |
| Chainguard | virt-api-1.8 | 0 |
| Chainguard | virt-api-fips-1.8 | 0 |
| Chainguard | virt-chroot-1.6 | 0 |
| Chainguard | virt-chroot-1.7 | 0 |
| Chainguard | virt-chroot-1.8 | 0 |
| Chainguard | virt-chroot-fips-1.6 | 0 |
| Chainguard | virt-chroot-fips-1.7 | 0 |
| Chainguard | virt-chroot-fips-1.8 | 0 |
| Chainguard | virt-controller-1.8 | 0 |
| Chainguard | virt-controller-fips-1.8 | 0 |
| Chainguard | virt-handler-1.6 | 0 |
| Chainguard | virt-handler-1.7 | 0 |
| Chainguard | virt-handler-1.8 | 0 |
| Chainguard | virt-handler-fips-1.6 | 0 |
| Chainguard | virt-handler-fips-1.7 | 0 |
| Chainguard | virt-handler-fips-1.8 | 0 |
| Chainguard | virt-launcher-1.6 | 0 |
| Chainguard | virt-launcher-1.7 | 0 |
| Chainguard | virt-launcher-1.8 | 0 |
| Chainguard | virt-launcher-1.8-virt-freezer | 0 |
| Chainguard | virt-operator-1.8 | 0 |
| Chainguard | virt-operator-fips-1.8 | 0 |
| Debian 12 | runc | no fix |
| Debian 13 | runc | no fix |
| Debian 14 | runc | 1.3.6+ds1-1 |
| SUSE Enterprise Storage 7.1 | runc | 1.3.6-150000.101.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS | runc | 1.3.6-150000.101.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS | runc | 1.3.6-150000.101.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS | runc | 1.3.6-150000.101.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS | runc | 1.3.6-150000.101.1 |
| SUSE Linux Enterprise Micro 5.3 | runc | 1.3.6-150000.101.1 |
| SUSE Linux Enterprise Micro 5.4 | runc | 1.3.6-150000.101.1 |
| SUSE Linux Enterprise Micro 5.5 | runc | 1.3.6-150000.101.1 |
| SUSE Linux Enterprise Module for Basesystem 15 SP7 | runc | 1.3.6-150000.101.1 |
| SUSE Linux Enterprise Server 12 SP5-LTSS | runc | 1.3.6-16.76.1 |
| SUSE Linux Enterprise Server 15 SP4-LTSS | runc | 1.3.6-150000.101.1 |
| SUSE Linux Enterprise Server 15 SP5-LTSS | runc | 1.3.6-150000.101.1 |
| SUSE Linux Enterprise Server 15 SP6-LTSS | runc | 1.3.6-150000.101.1 |
| SUSE Linux Enterprise Server 16.0 | runc | 1.3.6-160000.1.1 |
| SUSE Linux Enterprise Server LTSS Extended Security 12 SP5 | runc | 1.3.6-16.76.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP4 | runc | 1.3.6-150000.101.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP5 | runc | 1.3.6-150000.101.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP6 | runc | 1.3.6-150000.101.1 |
| SUSE Linux Enterprise Server for SAP applications 16.0 | runc | 1.3.6-160000.1.1 |
| SUSE Linux Micro 6.0 | runc | 1.3.6-1.1 |
| SUSE Linux Micro 6.1 | runc | 1.3.6-slfo.1.1_1.1 |
| SUSE Linux Micro 6.2 | runc | 1.3.6-160000.1.1 |
| Ubuntu 20.04 LTS | runc | no fix |
| Ubuntu 20.04 LTS | runc-app | no fix |
| Ubuntu 22.04 LTS | runc | no fix |
| Ubuntu 22.04 LTS | runc-app | no fix |
| Ubuntu 24.04 LTS | runc | no fix |
| Ubuntu 24.04 LTS | runc-app | no fix |
| Ubuntu 25.10 | runc | no fix |
| Ubuntu 25.10 | runc-app | no fix |
| Ubuntu 25.10 | runc-stable | no fix |
| Ubuntu 26.04 LTS | runc | no fix |
| Ubuntu 26.04 LTS | runc-app | no fix |
| Ubuntu 26.04 LTS | runc-stable | no fix |
| Ubuntu 26.10 | runc | no fix |
| Ubuntu 26.10 | runc-app | no fix |
| Ubuntu 26.10 | runc-stable | no fix |
| Ubuntu Pro 16.04 LTS | runc | no fix |
| Ubuntu Pro 18.04 LTS | runc | no fix |
| Wolfi | buildah | 1.44.0-r6 |
| Wolfi | cadvisor | 0.60.2-r1 |
| Wolfi | cadvisor-compat | 0.60.5-r8 |
| Wolfi | ctop | 0 |
| Wolfi | docker-machine-driver-harvester | 1.1.0-r1 |
| Wolfi | falco-no-driver | 0.45.0-r0 |
| Wolfi | k3s-1.32 | no fix |
| Wolfi | k3s-1.33 | no fix |
| Wolfi | k3s-static-1.32 | no fix |
| Wolfi | k3s-static-1.33 | no fix |
| Wolfi | mps-control-daemon | 0.20.0-r4 |
| Wolfi | node-feature-discovery-0.18 | 0.18.3-r19 |
| Wolfi | nvidia-container-toolkit-nvidia-cdi-hook | 1.19.1-r4 |
| Wolfi | nvidia-container-toolkit-nvidia-container-runtime | 1.19.1-r4 |
| Wolfi | nvidia-container-toolkit-nvidia-container-runtime-cdi | 1.19.1-r4 |
| Wolfi | nvidia-container-toolkit-nvidia-container-runtime-hook | 1.19.1-r4 |
| Wolfi | nvidia-container-toolkit-nvidia-container-runtime-legacy | 1.19.1-r4 |
| Wolfi | nvidia-container-toolkit-nvidia-ctk | 1.19.1-r4 |
| Wolfi | nvidia-container-toolkit-nvidia-ctk-installer | 1.19.1-r4 |
| Wolfi | nvidia-device-plugin | 0.19.3-r1 |
| Wolfi | podman | 6.0.0-r3 |
| Wolfi | podman | 6.0.0-r0 |
| Wolfi | sriov-network-device-plugin | 3.11.0-r16 |
| openSUSE Leap 16.0 | govulncheck-vulndb | 0.0.20260723T184607-160000.1.1 |
| openSUSE Leap 16.0 | runc | 1.3.6-160000.1.1 |
| openSUSE Tumbleweed | runc | 1.4.3-1.1 |