Link following in crun - CVE-2026-88265
Published: September 24, 2026
Vulnerability identifier: #VU151956
CSH Severity: Medium
CVSS v4: 5.9 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-88265
CWE-ID: CWE-59
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to modify and potentially take ownership of a host bind-mounted file.
The vulnerability exists due to improper link resolution and standard stream identification in crun's standard input/output reopening logic when reopening standard streams after entering the container mount namespace. A remote attacker can provide a crafted root filesystem in which /dev/null is a symlink to a bind-mounted host file to modify and potentially take ownership of a host bind-mounted file.
Exploitation requires crun to run with host-root credentials, no fresh tmpfs or devtmpfs mounted on /dev, and container standard streams using pipes or socketpairs.
Affected software
crun
How to mitigate CVE-2026-88265
Install security update from vendor's website.
crun - update to 1.30