CVE-2026-88264
Fixed in a distro release EPSS <1%CVSS 5.6
A flaw was found in crun. When the container configuration does not give /dev a dedicated mount, terminal setup can redirect /dev/console onto an attacker-controlled path, including via the read-only-rootfs bind-mount fallback. Affected versions are crun 1.29.1 and earlier. Default configurations that mount a fresh /dev are not exposed. No fixed release is available yet.
Products: containers crun, Red Hat Hardened Images, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | crun | no fix |
| Debian 13 | crun | no fix |
| Debian 14 | crun | no fix |
| Red Hat hummingbird 1 | crun | 0:1.30-1.hum1 |
| Red Hat hummingbird 1 | crun-krun | 0:1.30-1.hum1 |
| Red Hat hummingbird 1 | crun-wasm | 0:1.30-1.hum1 |
| Ubuntu 20.04 LTS | crun | no fix |
| Ubuntu 22.04 LTS | crun | no fix |
| Ubuntu 24.04 LTS | crun | no fix |
| Ubuntu 26.04 LTS | crun | no fix |
| Ubuntu 26.10 | crun | no fix |
| openSUSE Tumbleweed | crun | 1.30.1-1.1 |