Read the docs
TI-2026-35263 Aliases CVE-2026-47766

crun follows rootfs /dev symlink while creating default devices

Priority LOW 23CWE-61Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · Low · None
Fix status
Partial Red Hat: 1 fixed, 4 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat.

Summary

crun is an open source OCI Container Runtime fully written in C. Prior to version 1.28, crun's default device setup opens the container rootfs `/dev` directory without `O_NOFOLLOW`. If an OCI bundle contains `rootfs/dev` as a symlink and the bundle configuration does not mount `/dev`, crun follows that symlink and creates the default device nodes and stdio symlinks at the symlink target outside the container rootfs. In a local rootful crun replay, this created fixed device nodes and symlinks outside the rootfs before crun returned failure. A pre-existing file named `ptmx` in the target directory was also replaced by crun's forced `ptmx -> pts/ptmx` symlink. Version 1.28 fixes the issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00196 9th percentileScored 2026-11-07
Fix Partial crun (containers): 1.28Red Hat: 1 advisoryRed Hat: 1 fixed, 4 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
containerscrunbefore 1.281.28Patch availableCNA
  • crun Vendorcontainers Affected before 1.28 Fixed in 1.28 Patch available CNA

Remediation

  • Fix · CNA crun (containers) Fixed in 1.28

Red Hat 1 advisory

  • RHSA-2026:54855 Released 2026-08-14 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images crun-1.28-2.hum1@aarch64, crun-1.28-2.hum1@src, crun-1.28-2.hum1@x86_64 +4

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 10AffectedNo fix yet
Red Hat Enterprise Linux 8AffectedNo fix yet
Red Hat Enterprise Linux 9AffectedNo fix yet
Red Hat OpenShift Container Platform 4AffectedNo fix yet
Red Hat Hardened ImagesFixed RHSA-2026:54855

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-47766
  2. 2026-10-20 Fix available: RHSA-2026:54855 · Red Hat
  3. 2026-10-20 Fix available: Red Hat Hardened Images · Red Hat
  4. 2026-10-20 CVSS score added · Red Hat
  5. 2026-10-24 Affected versions changed · Red Hat

References

Other 2

  • TI-2025-18645 .krun_config.json symlink attack creates or overwrites file on the host in crun CVSS 4.0HIGH 8.5
  • TI-2026-23721 Crun incorrectly parses `crun exec` option `-u`, leading to privilege escalation CVSS 3.1HIGH 7.8
  • TI-2026-37901 fuse-overlayfs release-1.x preserves SUID/SGID bits after truncate/open(O_TRUNC) CVSS 4.0LOW 2.0
  • TI-2026-29788 bubblewrap vulnerable to privilege escalation in setuid mode via ptrace CVSS 4.0HIGH 8.7
  • TI-2024-07805 Containers/aardvark-dns: tcp query handling flaw in aardvark-dns leading to denial of service CVSS 3.1HIGH 7.5
  • TI-2024-08665 Podman: buildah: cri-o: fips crypto-policy directory mounting issue in containers/common go library CVSS 3.1HIGH 8.2
See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences