SB2026092475 - Multiple vulnerabilities in crun

Description

This security bulletin contains information about 2 vulnerabilities.

1) Link following (CVE-ID: CVE-2026-88264)

CWE-ID: CWE-59 - Improper Link Resolution Before File Access ('Link Following')

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to create a root-owned file outside the container root file system.

The vulnerability exists due to improper link resolution in the /dev/console setup when setting up terminal support. A remote attacker can provide a container root file system containing a malicious /dev/console symlink to create a root-owned file outside the container root file system.

Exploitation requires rootful crun, terminal support enabled, and a /dev configuration that preserves the malicious root file system entry during device setup.

2) Link following (CVE-ID: CVE-2026-88265)

CWE-ID: CWE-59 - Improper Link Resolution Before File Access ('Link Following')

CVSSv4: 5.9 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to modify and potentially take ownership of a host bind-mounted file.

The vulnerability exists due to improper link resolution and standard stream identification in crun's standard input/output reopening logic when reopening standard streams after entering the container mount namespace. A remote attacker can provide a crafted root filesystem in which /dev/null is a symlink to a bind-mounted host file to modify and potentially take ownership of a host bind-mounted file.

Exploitation requires crun to run with host-root credentials, no fresh tmpfs or devtmpfs mounted on /dev, and container standard streams using pipes or socketpairs.

Remediation

Install update from vendor's website.

References

• https://github.com/containers/crun/security/advisories/GHSA-j87h-qqch-77vc
• https://github.com/containers/crun/security/advisories/GHSA-5j66-q287-fhqw