CVE-2026-88265
Fixed in a distro release EPSS <1%CVSS 5.6
A flaw was found in crun. After pivot_root, reopening /dev/null for stdio can follow a symlink and attach a host file to container stdio, then change that file's ownership. Affected versions are crun 1.29.1 and earlier. Default configurations that mount a fresh /dev are not exposed. No fixed release is available yet.
Products: Red Hat Hardened Images, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | crun | no fix |
| Debian 13 | crun | no fix |
| Debian 14 | crun | no fix |
| Red Hat hummingbird 1 | crun | 0:1.30-1.hum1 |
| Red Hat hummingbird 1 | crun-krun | 0:1.30-1.hum1 |
| Red Hat hummingbird 1 | crun-wasm | 0:1.30-1.hum1 |
| Ubuntu 20.04 LTS | crun | no fix |
| Ubuntu 22.04 LTS | crun | no fix |
| Ubuntu 24.04 LTS | crun | no fix |
| Ubuntu 26.04 LTS | crun | no fix |
| Ubuntu 26.10 | crun | no fix |
| openSUSE Tumbleweed | crun | 1.30.1-1.1 |