Crun: crun: /dev/console symlink follow allows root-owned file creation outside the rootfs
Priority LOW 24CWE-59Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- High
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Partial Red Hat: 1 fixed, 5 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat.
Summary
A flaw was found in crun. When the container configuration does not give /dev a dedicated mount, terminal setup can redirect /dev/console onto an attacker-controlled path, including via the read-only-rootfs bind-mount fallback. Affected versions are crun 1.29.1 and earlier. Default configurations that mount a fresh /dev are not exposed. No fixed release is available yet.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00121 1st percentileScored 2026-11-07
Fix Partial Red Hat: 1 advisoryRed Hat: 1 fixed, 5 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| containers | crun | up to 1.29.1 | — | No fix listed | CNA |
| Red Hat | Red Hat Hardened Images | — | 1.30-1.hum1 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 10 | — | — | No fix listed | CNA |
| Red Hat | Red Hat Enterprise Linux 8 | — | — | No fix listed | CNA |
| Red Hat | Red Hat Enterprise Linux 9 | — | — | No fix listed | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4 | — | — | No fix listed | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4 | — | — | No fix listed | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4 | — | — | No fix listed | CNA |
| Red Hat | Red Hat OpenShift Container Platform 5 | — | — | No fix listed | CNA |
- crun Vendorcontainers Affected up to 1.29.1 Fixed in — No fix listed CNA
- Red Hat Hardened Images VendorRed Hat Affected — Fixed in 1.30-1.hum1 Patch available CNA
- Red Hat Enterprise Linux 10 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Enterprise Linux 8 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Enterprise Linux 9 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat OpenShift Container Platform 4 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat OpenShift Container Platform 4 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat OpenShift Container Platform 4 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat OpenShift Container Platform 5 VendorRed Hat Affected — Fixed in — No fix listed CNA
CPE names CNA · 6
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:/a:redhat:hummingbird:1 | 1 | — | Red Hat |
| cpe:/a:redhat:enterprise_linux:10 | 10 | — | Red Hat |
| cpe:/a:redhat:enterprise_linux:8 | 8 | — | Red Hat |
| cpe:/a:redhat:enterprise_linux:9 | 9 | — | Red Hat |
| cpe:/a:redhat:openshift:4 | 4 | — | Red Hat |
| cpe:/a:redhat:openshift:5 | 5 | — | Red Hat |
- cpe:/a:redhat:hummingbird:1 Versions 1 — ·Red Hat
- cpe:/a:redhat:enterprise_linux:10 Versions 10 — ·Red Hat
- cpe:/a:redhat:enterprise_linux:8 Versions 8 — ·Red Hat
- cpe:/a:redhat:enterprise_linux:9 Versions 9 — ·Red Hat
- cpe:/a:redhat:openshift:4 Versions 4 — ·Red Hat
- cpe:/a:redhat:openshift:5 Versions 5 — ·Red Hat
Remediation
Red Hat 1 advisory
- RHSA-2026:71668 Released 2026-09-24 · Red Hat rating ModerateRed Hat Hardened Images RPMs bug fix and enhancement update
- Red Hat Hardened Images crun-1.30-1.hum1@aarch64, crun-1.30-1.hum1@src, crun-1.30-1.hum1@x86_64 +4
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Advisory ·
Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8 and 4 more products — RHSA-2026:71668
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2026-60094 Crun: crun: /dev/null symlink follow during stdio reopen allows host bind-mount write and chownPriority LOW 24
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 10 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 8 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 9 | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Container Platform 5 | Affected | No fix yet: Fix deferred |
| Red Hat Hardened Images | Fixed | RHSA-2026:71668 |
Timeline
- 2026-10-02 Threatist record created from CVE-2026-88264
- 2026-10-03 Alias added: GHSA-ppgw-cqj8-9qrg
- 2026-11-06 Affected versions changed · CNA
- 2026-11-06 Affected versions changed · Red Hat
References
More containers vulnerabilities
- TI-2025-18645 .krun_config.json symlink attack creates or overwrites file on the host in crun CVSS 4.0HIGH 8.5
- TI-2026-23721 Crun incorrectly parses `crun exec` option `-u`, leading to privilege escalation CVSS 3.1HIGH 7.8
- TI-2026-37901 fuse-overlayfs release-1.x preserves SUID/SGID bits after truncate/open(O_TRUNC) CVSS 4.0LOW 2.0
- TI-2026-29788 bubblewrap vulnerable to privilege escalation in setuid mode via ptrace CVSS 4.0HIGH 8.7
- TI-2024-07805 Containers/aardvark-dns: tcp query handling flaw in aardvark-dns leading to denial of service CVSS 3.1HIGH 7.5
- TI-2024-08665 Podman: buildah: cri-o: fips crypto-policy directory mounting issue in containers/common go library CVSS 3.1HIGH 8.2
Sources
- CVE-2026-88264 · CVE Program
- CVE-2026-88264 · NVD
- FIRST EPSS
- GHSA-ppgw-cqj8-9qrg · GitHub Advisory Database · CC BY 4.0
- CVE-2026-88264 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences