CVE-2026-84042
Fixed in a distro release EPSS <1%CVSS 7.8
A flaw was found in crun. When crun is built with libkrun and a container is started rootful with passt networking (krun.use_passt), crun can execute attacker-controlled payload from the container image with host root privileges. The issue is a regression in crun 1.29. It affects crun >= 1.29
Products: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Hardened Images, Red Hat OpenShift Container Platform 4
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu 20.04 LTS | crun | no fix |
| Ubuntu 22.04 LTS | crun | no fix |
| Ubuntu 24.04 LTS | crun | no fix |
| Ubuntu 26.04 LTS | crun | no fix |
| Ubuntu 26.10 | crun | no fix |
| openSUSE Tumbleweed | crun | 1.30.1-1.1 |