Read the docs
TI-2025-32917 Aliases CVE-2025-52881GHSA-cgrx-mc8f-2prm

runc: LSM labels can be bypassed with malicious config using dummy procfs files

Priority LOW 35CWE-363Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
Active
Attack complexity
Low
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 46 fixed, 15 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat.

Summary

runc is a CLI tool for spawning and running containers according to the OCI specification. In versions 1.2.7, 1.3.2 and 1.4.0-rc.2, an attacker can trick runc into misdirecting writes to /proc to other procfs files through the use of a racing container with shared mounts (we have also verified this attack is possible to exploit using a standard Dockerfile with docker buildx build as that also permits triggering parallel execution of containers with custom shared mounts configured). This redirect could be through symbolic links in a tmpfs or theoretically other methods such as regular bind-mounts. While similar, the mitigation applied for the related CVE, CVE-2019-19921, was fairly limited and effectively only caused runc to verify that when LSM labels are written they are actually procfs files. This issue is fixed in versions 1.2.8, 1.3.3, and 1.4.0-rc.3.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00801 56th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial github.com/opencontainers/runc (Go): 1.2.8, 1.3.3, 1.4.0-rc.3github.com/opencontainers/selinux (Go): 1.13.0Red Hat: 61 advisoriesRed Hat: 46 fixed, 15 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
backstagerunc<= 1.2.7, < 1.2.8; <= 1.3.2, < 1.3.3; <= 1.4.0-rc.2, < 1.4.0-rc.3—No fix listedCNA
—github.com/opencontainers/runc (Go)before 1.2.81.2.8Patch availableGHSA-cgrx-mc8f-2prm
—github.com/opencontainers/selinux (Go)before 1.13.01.13.0Patch availableGHSA-cgrx-mc8f-2prm
—github.com/opencontainers/runc (Go)1.3.0-rc.1 to before 1.3.31.3.3Patch availableGHSA-cgrx-mc8f-2prm
—github.com/opencontainers/runc (Go)1.4.0-rc.1 to before 1.4.0-rc.31.4.0-rc.3Patch availableGHSA-cgrx-mc8f-2prm
  • runc Vendorbackstage Affected <= 1.2.7, < 1.2.8; <= 1.3.2, < 1.3.3; <= 1.4.0-rc.2, < 1.4.0-rc.3 Fixed in — No fix listed CNA
  • github.com/opencontainers/runc (Go) Vendor— Affected before 1.2.8 Fixed in 1.2.8 Patch available GHSA-cgrx-mc8f-2prm
  • github.com/opencontainers/selinux (Go) Vendor— Affected before 1.13.0 Fixed in 1.13.0 Patch available GHSA-cgrx-mc8f-2prm
  • github.com/opencontainers/runc (Go) Vendor— Affected 1.3.0-rc.1 to before 1.3.3 Fixed in 1.3.3 Patch available GHSA-cgrx-mc8f-2prm
  • github.com/opencontainers/runc (Go) Vendor— Affected 1.4.0-rc.1 to before 1.4.0-rc.3 Fixed in 1.4.0-rc.3 Patch available GHSA-cgrx-mc8f-2prm

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:linuxfoundation:runc:*:*:*:*:*:*:*:*before 1.2.8; 1.3.0 to before 1.3.3Vulnerablebackstage
cpe:2.3:a:linuxfoundation:runc:1.4.0:rc1:*:*:*:*:*:*1.4.0 rc1Vulnerablebackstage
cpe:2.3:a:linuxfoundation:runc:1.4.0:rc2:*:*:*:*:*:*1.4.0 rc2Vulnerablebackstage
  • cpe:2.3:a:linuxfoundation:runc:*:*:*:*:*:*:*:* Versions before 1.2.8; 1.3.0 to before 1.3.3 Vulnerable ·backstage
  • cpe:2.3:a:linuxfoundation:runc:1.4.0:rc1:*:*:*:*:*:* Versions 1.4.0 rc1 Vulnerable ·backstage
  • cpe:2.3:a:linuxfoundation:runc:1.4.0:rc2:*:*:*:*:*:* Versions 1.4.0 rc2 Vulnerable ·backstage

Remediation

  • Fix · GHSA-cgrx-mc8f-2prm github.com/opencontainers/runc (Go) Fixed in 1.2.8 Advisory →
  • Fix · GHSA-cgrx-mc8f-2prm github.com/opencontainers/selinux (Go) Fixed in 1.13.0 Advisory →
  • Fix · GHSA-cgrx-mc8f-2prm github.com/opencontainers/runc (Go) Fixed in 1.3.3 Advisory →
  • Fix · GHSA-cgrx-mc8f-2prm github.com/opencontainers/runc (Go) Fixed in 1.4.0-rc.3 Advisory →

Red Hat 61 advisories

  • RHSA-2026:72851 Released 2026-09-28 · Red Hat rating Important
    multicluster engine for Kubernetes v2.9.8 security update
    • multicluster engine for Kubernetes 2.9 registry.redhat.io/multicluster-engine/addon-manager-rhel9, registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9, registry.redhat.io/multicluster-engine/console-mce-rhel9 +7
  • RHSA-2026:61629 Released 2026-08-31 · Red Hat rating Important
    Red Hat AI Inference Server 3.2.2 (ROCm)
    • Red Hat AI Inference Server 3.2 registry.redhat.io/rhaiis/vllm-rocm-rhel9
  • RHSA-2026:61628 Released 2026-08-31 · Red Hat rating Important
    Red Hat AI Inference Server Model Optimization Tools 3.2.2 (CUDA)
    • Red Hat AI Inference Server 3.2 registry.redhat.io/rhaiis/model-opt-cuda-rhel9
Show 58 more Red Hat advisories
  • RHSA-2026:61627 Released 2026-08-31 · Red Hat rating Important
    Red Hat AI Inference Server 3.2.2 (CUDA)
    • Red Hat AI Inference Server 3.2 registry.redhat.io/rhaiis/vllm-cuda-rhel9
  • RHSA-2026:41928 Released 2026-07-20 · Red Hat rating Important
    Red Hat Migration Toolkit for Containers
    • Red Hat Migration Toolkit 1.8 registry.redhat.io/rhmtc/openshift-migration-controller-rhel8, registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8, registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8 +6
  • RHSA-2026:39894 Released 2026-07-15 · Red Hat rating Important
    Release of containers for RHOSO 18.0.21
    • Red Hat OpenStack Services on OpenShift 18.0 registry.redhat.io/rhoso-operators/ee-openstack-ansible-ee-rhel9, registry.redhat.io/rhoso-operators/prometheus-podman-exporter-rhel9, registry.redhat.io/rhoso-operators/sg-core-rhel9
  • RHSA-2026:37387 Released 2026-07-09 · Red Hat rating Important
    Red Hat OpenShift Data Foundation 4.22.0 security, enhancement & bug fix update
    • Red Hat Openshift Data Foundation 4.22 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/devicefinder-rhel9 +24
  • RHSA-2026:19244 Released 2026-05-19 · Red Hat rating Important
    Red Hat OpenShift Data Foundation 4.14.32 security, enhancement & bug fix update
    • Red Hat Openshift Data Foundation 4.14 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/mcg-cli-rhel9, registry.redhat.io/odf4/mcg-core-rhel9 +15
  • RHSA-2026:10703 Released 2026-04-27 · Red Hat rating Important
    container-tools:rhel8 security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.6) aardvark-dns-2:1.0.1-40.module+el8.6.0+24209+25a14987.x86_64::container-tools:rhel8, buildah-1:1.26.10-1.module+el8.6.0+24209+25a14987.src::container-tools:rhel8, buildah-1:1.26.10-1.module+el8.6.0+24209+25a14987.x86_64::container-tools:rhel8 +47
    • Red Hat Enterprise Linux AppStream E4S (v.8.6) aardvark-dns-2:1.0.1-40.module+el8.6.0+24209+25a14987.aarch64::container-tools:rhel8, aardvark-dns-2:1.0.1-40.module+el8.6.0+24209+25a14987.ppc64le::container-tools:rhel8, aardvark-dns-2:1.0.1-40.module+el8.6.0+24209+25a14987.s390x::container-tools:rhel8 +47
    • Red Hat Enterprise Linux AppStream TUS (v.8.6) aardvark-dns-2:1.0.1-40.module+el8.6.0+24209+25a14987.x86_64::container-tools:rhel8, buildah-1:1.26.10-1.module+el8.6.0+24209+25a14987.src::container-tools:rhel8, buildah-1:1.26.10-1.module+el8.6.0+24209+25a14987.x86_64::container-tools:rhel8 +47
  • RHSA-2026:8433 Released 2026-04-16 · Red Hat rating Important
    OpenShift Compliance Operator bug fix and enhancement update
    • OpenShift Compliance Operator 1 registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8, registry.redhat.io/compliance/openshift-compliance-operator-bundle, registry.redhat.io/compliance/openshift-compliance-rhel8-operator
  • RHSA-2026:8325 Released 2026-04-15 · Red Hat rating Important
    buildah, crun, podman, runc, and skopeo security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.0) buildah-1:1.26.9-1.el9_0.3, buildah-tests-1:1.26.9-1.el9_0.3, podman-2:4.2.0-6.el9_0.6 +9
  • RHSA-2026:4693 Released 2026-03-17 · Red Hat rating Important
    container-tools:rhel8 security update
    • Red Hat Enterprise Linux AppStream E4S (v.8.8) aardvark-dns-2:1.5.0-2.module+el8.8.0+23884+2031fc78.ppc64le::container-tools:rhel8, aardvark-dns-2:1.5.0-2.module+el8.8.0+23884+2031fc78.src::container-tools:rhel8, aardvark-dns-2:1.5.0-2.module+el8.8.0+23884+2031fc78.x86_64::container-tools:rhel8 +47
    • Red Hat Enterprise Linux AppStream TUS (v.8.8) aardvark-dns-2:1.5.0-2.module+el8.8.0+23884+2031fc78.src::container-tools:rhel8, aardvark-dns-2:1.5.0-2.module+el8.8.0+23884+2031fc78.x86_64::container-tools:rhel8, buildah-1:1.29.7-1.module+el8.8.0+24026+ca15dd94.src::container-tools:rhel8 +47
  • RHSA-2026:4533 Released 2026-03-12 · Red Hat rating Important
    podman security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.2) podman-2:4.4.1-22.el9_2.5, podman-docker-2:4.4.1-22.el9_2.5, podman-gvproxy-2:4.4.1-22.el9_2.5 +3
  • RHSA-2026:4532 Released 2026-03-12 · Red Hat rating Important
    buildah security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.2) buildah-1:1.29.5-1.el9_2.2, buildah-tests-1:1.29.5-1.el9_2.2
  • RHSA-2026:4531 Released 2026-03-12 · Red Hat rating Important
    runc security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.2) runc-4:1.2.9-1.el9_2.1
  • RHSA-2026:4215 Released 2026-03-10 · Red Hat rating Important
    Red Hat Quay 3.14.6
    • Red Hat Quay 3.14 registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:4185 Released 2026-03-10 · Red Hat rating Important
    Red Hat Quay 3.13.11
    • Red Hat Quay 3.13 registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:3416 Released 2026-03-04 · Red Hat rating Important
    OpenShift Container Platform 4.17.50 packages and security update
    • Red Hat OpenShift Container Platform 4.17 buildah-2:1.33.12-3.rhaos4.17.el8, buildah-2:1.33.12-3.rhaos4.17.el9, buildah-tests-2:1.33.12-3.rhaos4.17.el8 +8
  • RHSA-2026:3713 Released 2026-03-04 · Red Hat rating Critical
    RHOAI 3.3 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.3 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9, registry.redhat.io/rhoai/odh-data-science-pipelines-argo-argoexec-rhel9 +47
  • RHSA-2026:2975 Released 2026-02-25 · Red Hat rating Important
    OpenShift Container Platform 4.18.34 packages and security update
    • Red Hat OpenShift Container Platform 4.18 buildah-2:1.33.12-2.rhaos4.18.el9, buildah-tests-2:1.33.12-2.rhaos4.18.el9
  • RHSA-2026:2951 Released 2026-02-18 · Red Hat rating Important
    Red Hat OpenShift API for Data Protection
    • OpenShift API for Data Protection 1.4 registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9, registry.redhat.io/oadp/oadp-mustgather-rhel9, registry.redhat.io/oadp/oadp-rhel9-operator +7
  • RHSA-2026:2900 Released 2026-02-18 · Red Hat rating Important
    Network Observability 1.11.0 for OpenShift
    • Network Observability (NETOBSERV) 1.11.0 registry.redhat.io/network-observability/network-observability-cli-rhel9, registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9, registry.redhat.io/network-observability/network-observability-console-plugin-rhel9 +2
  • RHSA-2026:2762 Released 2026-02-16 · Red Hat rating Important
    Red Hat Quay 3.10.18
    • Red Hat Quay 3.10 registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:2754 Released 2026-02-16 · Red Hat rating Important
    Red Hat Quay 3.9.18
    • Red Hat Quay 3.9 registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:2695 Released 2026-02-12 · Red Hat rating Important
    RHOAI 2.25.2 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-dashboard-rhel9, registry.redhat.io/rhoai/odh-data-science-pipelines-argo-argoexec-rhel9, registry.redhat.io/rhoai/odh-data-science-pipelines-argo-workflowcontroller-rhel9 +13
  • RHSA-2026:2681 Released 2026-02-12 · Red Hat rating Important
    Red Hat Quay 3.16.2
    • Red Hat Quay 3.16 registry.redhat.io/quay/quay-builder-rhel9, registry.redhat.io/quay/quay-rhel9
  • RHSA-2026:2456 Released 2026-02-10 · Red Hat rating Important
    Red Hat OpenShift Dev Spaces 3.26.0 Release.
    • Red Hat OpenShift Dev Spaces (RHOSDS) 3.26 registry.redhat.io/devspaces/code-rhel9, registry.redhat.io/devspaces/configbump-rhel9, registry.redhat.io/devspaces/dashboard-rhel9 +9
  • RHSA-2026:2343 Released 2026-02-09 · Red Hat rating Important
    Red Hat OpenShift API for Data Protection
    • OpenShift API for Data Protection 1.5 registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9, registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9, registry.redhat.io/oadp/oadp-mustgather-rhel9 +8
  • RHSA-2026:1540 Released 2026-02-05 · Red Hat rating Important
    OpenShift Container Platform 4.15.61 packages and security update
    • Ironic content for Red Hat OpenShift Container Platform 4.15 python-eventlet-0.33.1-7.el9, python3-eventlet-0.33.1-7.el9
    • Red Hat OpenShift Container Platform 4.15 bpftool-7.0.0-284.155.1.el9_2, kernel-5.14.0-284.155.1.el9_2, kernel-64k-5.14.0-284.155.1.el9_2 +47
  • RHSA-2026:2106 Released 2026-02-05 · Red Hat rating Important
    RHOAI 2.25.2 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-caikit-nlp-rhel9, registry.redhat.io/rhoai/odh-caikit-tgis-serving-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9 +47
  • RHSA-2026:2034 Released 2026-02-05 · Red Hat rating Important
    Red Hat OpenShift Data Foundation 4.20 security, enhancement & bug fix update
    • Red Hat Openshift Data Foundation 4.20 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/mcg-core-rhel9 +19
  • RHSA-2026:1942 Released 2026-02-04 · Red Hat rating Important
    Red Hat Quay 3.15.3
    • Red Hat Quay 3.15 registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:1730 Released 2026-02-02 · Red Hat rating Important
    Red Hat Quay 3.12.13
    • Red Hat Quay 3.12 registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:0995 Released 2026-01-30 · Red Hat rating Important
    OpenShift Container Platform 4.14.61 packages and security update
    • Red Hat OpenShift Container Platform 4.14 runc-4:1.2.9-1.rhaos4.16.el8, runc-4:1.2.9-1.rhaos4.16.el9
  • RHSA-2026:0676 Released 2026-01-22 · Red Hat rating Important
    OpenShift Container Platform 4.13.63 packages and security update
    • Red Hat OpenShift Container Platform 4.13 runc-4:1.2.9-1.rhaos4.16.el8, runc-4:1.2.9-1.rhaos4.16.el9
  • RHSA-2026:0701 Released 2026-01-22 · Red Hat rating Important
    OpenShift Container Platform 4.17.47 packages and security update
    • Red Hat OpenShift Container Platform 4.17 runc-4:1.2.9-1.rhaos4.17.el9
  • RHSA-2026:0418 Released 2026-01-15 · Red Hat rating Important
    OpenShift Container Platform 4.16.55 packages and security update
    • Red Hat OpenShift Container Platform 4.16 runc-4:1.2.9-1.rhaos4.16.el8, runc-4:1.2.9-1.rhaos4.16.el9
  • RHSA-2026:0331 Released 2026-01-15 · Red Hat rating Important
    OpenShift Container Platform 4.18.31 packages and security update
    • Red Hat OpenShift Container Platform 4.18 runc-4:1.2.9-1.rhaos4.18.el8, runc-4:1.2.9-1.rhaos4.18.el9
  • RHSA-2026:0316 Released 2026-01-15 · Red Hat rating Important
    OpenShift Container Platform 4.12.84 bug fix and security update
    • Red Hat OpenShift Container Platform 4.12 rhcos-x86_64-412.86.202601061735-0
  • RHSA-2026:0315 Released 2026-01-15 · Red Hat rating Important
    OpenShift Container Platform 4.12.84 packages and security update
    • Red Hat OpenShift Container Platform 4.12 runc-4:1.2.9-1.rhaos4.17.el8
  • RHSA-2026:0425 Released 2026-01-12 · Red Hat rating Important
    runc security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.4) runc-4:1.2.9-1.el9_4
  • RHSA-2026:0426 Released 2026-01-12 · Red Hat rating Important
    buildah security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.4) buildah-2:1.33.13-2.el9_4.1, buildah-tests-2:1.33.13-2.el9_4.1
  • RHSA-2026:0424 Released 2026-01-12 · Red Hat rating Important
    podman security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.4) podman-4:4.9.4-19.el9_4.5, podman-docker-4:4.9.4-19.el9_4.5, podman-plugins-4:4.9.4-19.el9_4.5 +2
  • RHSA-2025:23113 Released 2026-01-07 · Red Hat rating Important
    OpenShift Container Platform 4.15.60 bug fix and security update
    • Red Hat OpenShift Container Platform 4.15 rhcos-aarch64-415.92.202512100122-0, rhcos-ppc64le-415.92.202512100122-0, rhcos-s390x-415.92.202512100122-0 +1
  • RHSA-2026:0050 Released 2026-01-05 · Red Hat rating Important
    Red Hat OpenShift Builds 1.6.2
    • Builds for Red Hat OpenShift 1.6.0 registry.redhat.io/openshift-builds/openshift-builds-shared-resource-rhel9, registry.redhat.io/openshift-builds/openshift-builds-shared-resource-webhook-rhel9
  • RHSA-2025:23347 Released 2025-12-18 · Red Hat rating Important
    podman security update
    • Red Hat Enterprise Linux AppStream EUS (v. 10.0) podman-6:5.4.0-14.el10_0, podman-docker-6:5.4.0-14.el10_0, podman-remote-6:5.4.0-14.el10_0
    • Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0) podman-tests-6:5.4.0-14.el10_0
  • RHSA-2025:23543 Released 2025-12-18 · Red Hat rating Important
    container-tools:rhel8 security update
    • Red Hat Enterprise Linux AppStream (v. 8) aardvark-dns-2:1.10.1-2.module+el8.10.0+23820+ae6deecc.aarch64::container-tools:rhel8, aardvark-dns-2:1.10.1-2.module+el8.10.0+23820+ae6deecc.ppc64le::container-tools:rhel8, aardvark-dns-2:1.10.1-2.module+el8.10.0+23820+ae6deecc.s390x::container-tools:rhel8 +47
  • RHSA-2025:22275 Released 2025-12-05 · Red Hat rating Important
    OpenShift Container Platform 4.13.62 bug fix and security update
    • Red Hat OpenShift Container Platform 4.13 rhcos-x86_64-413.92.202511261311-0
  • RHSA-2025:21824 Released 2025-11-27 · Red Hat rating Important
    OpenShift Container Platform 4.16.53 bug fix and security update
    • Red Hat OpenShift Container Platform 4.16 rhcos-aarch64-416.94.202511191934-0, rhcos-ppc64le-416.94.202511191934-0, rhcos-s390x-416.94.202511191934-0 +1
  • RHSA-2025:21795 Released 2025-11-27 · Red Hat rating Important
    OpenShift Container Platform 4.18.29 bug fix and security update
    • Red Hat OpenShift Container Platform 4.18 rhcos-aarch64-418.94.202511170715-0, rhcos-ppc64le-418.94.202511170715-0, rhcos-s390x-418.94.202511170715-0 +1
  • RHSA-2025:22030 Released 2025-11-25 · Red Hat rating Important
    podman security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) podman-5:5.4.0-15.el9_6, podman-docker-5:5.4.0-15.el9_6, podman-plugins-5:5.4.0-15.el9_6 +2
  • RHSA-2025:22011 Released 2025-11-25 · Red Hat rating Important
    buildah security update
    • Red Hat Enterprise Linux AppStream (v. 9) buildah-2:1.41.6-1.el9_7, buildah-tests-2:1.41.6-1.el9_7
  • RHSA-2025:22012 Released 2025-11-25 · Red Hat rating Important
    buildah security update
    • Red Hat Enterprise Linux AppStream (v. 10) buildah-2:1.41.6-1.el10_1, buildah-tests-2:1.41.6-1.el10_1
  • RHSA-2025:21328 Released 2025-11-20 · Red Hat rating Important
    OpenShift Container Platform 4.14.59 packages and security update
    • Red Hat OpenShift Container Platform 4.14 containernetworking-plugins-1:1.4.0-5.rhaos4.14.el8, cri-o-1.27.8-16.rhaos4.14.gite1422c1.el8, cri-o-1.27.8-16.rhaos4.14.gite1422c1.el9 +8
  • RHSA-2025:21702 Released 2025-11-18 · Red Hat rating Important
    podman security update
    • Red Hat Enterprise Linux AppStream (v. 9) podman-6:5.6.0-7.el9_7, podman-docker-6:5.6.0-7.el9_7, podman-plugins-6:5.6.0-7.el9_7 +2
  • RHSA-2025:21634 Released 2025-11-18 · Red Hat rating Important
    buildah security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) buildah-2:1.39.5-1.el9_6, buildah-tests-2:1.39.5-1.el9_6
  • RHSA-2025:21633 Released 2025-11-18 · Red Hat rating Important
    buildah security update
    • Red Hat Enterprise Linux AppStream EUS (v. 10.0) buildah-2:1.39.5-1.el10_0, buildah-tests-2:1.39.5-1.el10_0
  • RHSA-2025:21232 Released 2025-11-13 · Red Hat rating Important
    container-tools:rhel8 security update
    • Red Hat Enterprise Linux AppStream (v. 8) aardvark-dns-2:1.10.1-2.module+el8.10.0+23647+cfd78660.aarch64::container-tools:rhel8, aardvark-dns-2:1.10.1-2.module+el8.10.0+23647+cfd78660.ppc64le::container-tools:rhel8, aardvark-dns-2:1.10.1-2.module+el8.10.0+23647+cfd78660.s390x::container-tools:rhel8 +47
  • RHSA-2025:21220 Released 2025-11-13 · Red Hat rating Important
    podman security update
    • Red Hat Enterprise Linux AppStream (v. 10) podman-7:5.6.0-6.el10_1, podman-docker-7:5.6.0-6.el10_1, podman-remote-7:5.6.0-6.el10_1
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) podman-tests-7:5.6.0-6.el10_1
  • RHSA-2025:20957 Released 2025-11-11 · Red Hat rating Important
    runc security update
    • Red Hat Enterprise Linux AppStream (v. 9) runc-4:1.3.0-4.el9_7
  • RHSA-2025:19927 Released 2025-11-07 · Red Hat rating Important
    runc security update
    • Red Hat Enterprise Linux AppStream (v. 9) runc-4:1.2.5-3.el9_6

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Assisted Installer for Red Hat OpenShift Container Platform 2AffectedNo fix yet
Logging Subsystem for Red Hat OpenShiftAffectedNo fix planned: Will not fix
Multicluster Engine for KubernetesAffectedNo fix yet
OpenShift API for Data ProtectionAffectedNo fix yet
OpenShift LightspeedAffectedNo fix yet
OpenShift ServerlessAffectedNo fix planned: Will not fix
Red Hat AI Inference ServerAffectedNo fix yet
Red Hat Ansible Automation Platform 2AffectedNo fix yet
Red Hat Build of KueueAffectedNo fix planned: Will not fix
Red Hat Certification Program for Red Hat Enterprise Linux 9AffectedNo fix yet
Red Hat Enterprise Linux AI (RHEL AI)AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux AI (RHEL AI) 3AffectedNo fix planned: Will not fix
Red Hat OpenShift Container Platform 4AffectedNo fix yet
Red Hat OpenShift Virtualization 4AffectedNo fix yet
Red Hat Quay 3AffectedNo fix yet
Builds for Red Hat OpenShift 1.6.0Fixed RHSA-2026:0050
Network Observability (NETOBSERV) 1.11.0Fixed RHSA-2026:2900
OpenShift API for Data Protection 1.4Fixed RHSA-2026:2951
OpenShift API for Data Protection 1.5Fixed RHSA-2026:2343
OpenShift Compliance Operator 1Fixed RHSA-2026:8433
Red Hat AI Inference Server 3.2Fixed RHSA-2026:61627, RHSA-2026:61628, RHSA-2026:61629
Red Hat Enterprise Linux AppStream (v. 10)Fixed RHSA-2025:21220, RHSA-2025:22012
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2025:21232, RHSA-2025:23543
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2025:19927, RHSA-2025:20957, RHSA-2025:21702, RHSA-2025:22011
Red Hat Enterprise Linux AppStream AUS (v.8.6)Fixed RHSA-2026:10703
Red Hat Enterprise Linux AppStream E4S (v.8.6)Fixed RHSA-2026:10703
Red Hat Enterprise Linux AppStream E4S (v.8.8)Fixed RHSA-2026:4693
Red Hat Enterprise Linux AppStream E4S (v.9.0)Fixed RHSA-2026:8325
Red Hat Enterprise Linux AppStream E4S (v.9.2)Fixed RHSA-2026:4531, RHSA-2026:4532, RHSA-2026:4533
Red Hat Enterprise Linux AppStream EUS (v. 10.0)Fixed RHSA-2025:21633, RHSA-2025:23347
Red Hat Enterprise Linux AppStream EUS (v.9.4)Fixed RHSA-2026:0424, RHSA-2026:0425, RHSA-2026:0426
Red Hat Enterprise Linux AppStream EUS (v.9.6)Fixed RHSA-2025:21634, RHSA-2025:22030
Red Hat Enterprise Linux AppStream TUS (v.8.6)Fixed RHSA-2026:10703
Red Hat Enterprise Linux AppStream TUS (v.8.8)Fixed RHSA-2026:4693
Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)Fixed RHSA-2025:21220
Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)Fixed RHSA-2025:23347
Red Hat Migration Toolkit 1.8Fixed RHSA-2026:41928
Red Hat OpenShift AI 2.25Fixed RHSA-2026:2106, RHSA-2026:2695
Red Hat OpenShift AI 3.3Fixed RHSA-2026:3713
Red Hat OpenShift Container Platform 4.12Fixed RHSA-2026:0315, RHSA-2026:0316
Red Hat OpenShift Container Platform 4.13Fixed RHSA-2025:22275, RHSA-2026:0676
Red Hat OpenShift Container Platform 4.14Fixed RHSA-2025:21328, RHSA-2026:0995
Red Hat OpenShift Container Platform 4.15Fixed RHSA-2025:23113, RHSA-2026:1540
Red Hat OpenShift Container Platform 4.16Fixed RHSA-2025:21824, RHSA-2026:0418
Red Hat OpenShift Container Platform 4.17Fixed RHSA-2026:0701, RHSA-2026:3416
Red Hat OpenShift Container Platform 4.18Fixed RHSA-2025:21795, RHSA-2026:0331, RHSA-2026:2975
Red Hat OpenShift Container Platform 4.19Fixed—
Red Hat OpenShift Container Platform 4.20Fixed—
Red Hat OpenShift Dev Spaces (RHOSDS) 3.26Fixed RHSA-2026:2456
Red Hat OpenStack Services on OpenShift 18.0Fixed RHSA-2026:39894
Red Hat Openshift Data Foundation 4.14Fixed RHSA-2026:19244
Red Hat Openshift Data Foundation 4.20Fixed RHSA-2026:2034
Red Hat Openshift Data Foundation 4.22Fixed RHSA-2026:37387
Red Hat Quay 3.10Fixed RHSA-2026:2762
Red Hat Quay 3.12Fixed RHSA-2026:1730
Red Hat Quay 3.13Fixed RHSA-2026:4185
Red Hat Quay 3.14Fixed RHSA-2026:4215
Red Hat Quay 3.15Fixed RHSA-2026:1942
Red Hat Quay 3.16Fixed RHSA-2026:2681
Red Hat Quay 3.9Fixed RHSA-2026:2754
multicluster engine for Kubernetes 2.9Fixed RHSA-2026:72851
Not affected: 54 products
  • Assisted Installer for Red Hat OpenShift Container Platform 2
  • Builds for Red Hat OpenShift 1.6.0
  • Confidential Compute Attestation
  • Custom Metric Autoscaler operator for Red Hat Openshift
  • File Integrity Operator
  • Ironic content for Red Hat OpenShift Container Platform 4.15
  • Kernel Module Management Operator for Red Hat Openshift
  • Logical Volume Manager Storage
  • Multicluster Engine for Kubernetes
  • Network Observability (NETOBSERV) 1.11.0
  • Node HealthCheck Operator
  • OpenShift API for Data Protection 1.4
  • OpenShift API for Data Protection 1.5
  • OpenShift Compliance Operator 1
  • OpenShift Developer Tools and Services
  • OpenShift Service Mesh 2
  • OpenShift Service Mesh 3
  • OpenShift Source-to-Image (S2I)
  • Power monitoring for Red Hat OpenShift
  • Red Hat AI Inference Server
  • Red Hat Advanced Cluster Management for Kubernetes 2
  • Red Hat Ansible Automation Platform 2
  • Red Hat Developer Hub 1
  • Red Hat Enterprise Linux 10
  • Red Hat Enterprise Linux 9
  • Red Hat Enterprise Linux AppStream E4S (v.9.0)
  • Red Hat Migration Toolkit 1.8
  • Red Hat OpenShift AI 2.25
  • Red Hat OpenShift AI 3.3
  • Red Hat OpenShift Container Platform 4
  • Red Hat OpenShift Container Platform 4.12
  • Red Hat OpenShift Container Platform 4.13
  • Red Hat OpenShift Container Platform 4.14
  • Red Hat OpenShift Container Platform 4.15
  • Red Hat OpenShift Container Platform 4.16
  • Red Hat OpenShift Container Platform 4.17
  • Red Hat OpenShift Container Platform 4.18
  • Red Hat OpenShift Container Platform 4.19
  • Red Hat OpenShift Dev Spaces (RHOSDS) 3.26
  • Red Hat OpenShift Virtualization 4
  • Red Hat OpenShift for Windows Containers
  • Red Hat OpenStack Platform 18.0
  • Red Hat OpenStack Services on OpenShift 18.0
  • Red Hat Openshift Data Foundation 4.14
  • Red Hat Openshift Data Foundation 4.20
  • Red Hat Openshift Data Foundation 4.22
  • Red Hat Quay 3.10
  • Red Hat Quay 3.12
  • Red Hat Quay 3.13
  • Red Hat Quay 3.14
  • Red Hat Quay 3.15
  • Red Hat Quay 3.16
  • Red Hat Quay 3.9
  • multicluster engine for Kubernetes 2.9

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-52881
  2. 2026-10-03 Alias added: GHSA-cgrx-mc8f-2prm
  3. 2026-10-09 Affected versions changed · Red Hat
  4. 2026-10-10 Fix available: Compliance Operator 1 · Red Hat
  5. 2026-10-25 EPSS moved to the 50th–90th percentile
  6. 2026-10-27 Affected versions changed · Red Hat
  7. 2026-11-01 Affected versions changed · Red Hat
  8. 2026-11-06 Fix available: OpenShift Compliance Operator 1 · Red Hat

References

Exploit 1

Patch 19

Advisory 1

Other 9

  • TI-2019-04061 runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows… CVSS 3.1HIGH 8.6
  • TI-2024-14351 runc container breakout through process.cwd trickery and leaked fds CVSS 3.1HIGH 8.6
  • TI-2021-10869 runc before 1.0.0-rc95 allows a Container Filesystem Breakout via Directory Traversal. CVSS 3.1HIGH 8.5
  • TI-2019-12591 runc through 1.0.0-rc8, as used in Docker through 19.03.2-ce and other products, allows… CVSS 3.1HIGH 7.5
  • TI-2025-32660 container escape due to /dev/console mount and related races CVSS 4.0HIGH 8.4
  • TI-2025-22394 runc container escape via "masked path" abuse due to mount race conditions CVSS 4.0HIGH 7.3
See all 16 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences