runc is a CLI tool for spawning and running containers according to the OCI specification. In versions 1.2.7, 1.3.2 and 1.4.0-rc.2, an attacker can trick runc into misdirecting writes to /proc to other procfs files through the use of a racing container with shared mounts (we have also verified this attack is possible to exploit using a standard Dockerfile with docker buildx build as that also permits triggering parallel execution of containers with custom shared mounts configured). This redirect could be through symbolic links in a tmpfs or theoretically other methods such as regular bind-mounts. While similar, the mitigation applied for the related CVE, CVE-2019-19921, was fairly limited and effectively only caused runc to verify that when LSM labels are written they are actually procfs files. This issue is fixed in versions 1.2.8, 1.3.3, and 1.4.0-rc.3.
CVSS Details
- CVSS 4.0 Base Score: 7.3 (HIGH)
- CVSS 4.0 Vector: (CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade buildahUpgrade criu-libsUpgrade python3-criuUpgrade container-selinuxUpgrade podman-remoteUpgrade podman-catatonitUpgrade libslirp-develUpgrade critUpgrade containernetworking-pluginsUpgrade podmanUpgrade udicaUpgrade fuse-overlayfsUpgrade criuUpgrade aardvark-dnsUpgrade containers-commonUpgrade runcUpgrade skopeoUpgrade oci-seccomp-bpf-hookUpgrade conmonUpgrade podman-pluginsUpgrade crunUpgrade libslirpUpgrade skopeo-testsUpgrade python3-podmanUpgrade toolboxUpgrade buildah-testsUpgrade podman-dockerUpgrade podman-testsUpgrade toolbox-testsUpgrade podman-gvproxyUpgrade cockpit-podmanUpgrade slirp4netnsUpgrade netavarkUpgrade criu-devel | Nov 11, 2025 | Nov 7, 2025 |
| Alpine Linux | — | Upgrade podmanUpgrade buildahUpgrade runc | Nov 7, 2025 | Nov 6, 2025 |
| Amazon Linux Ami 2 | — | Upgrade runc-debuginfoUpgrade runc | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade runcUpgrade runc-debugsourceUpgrade runc-debuginfo | Nov 7, 2025 | Nov 5, 2025 |
| Arista Eos | — | Upgrade to a fixed EOS release. | Apr 29, 2026 | Apr 7, 2026 |
| Dell Powerstore Dsa2026115 | — | Upgrade Dell PowerStoreOS to the latest version | Feb 25, 2026 | Feb 24, 2026 |
| Huawei Euleros 2_0_sp10 | — | Upgrade docker-runc | Mar 17, 2026 | Mar 17, 2026 |
| Huawei Euleros 2_0_sp11 | — | Upgrade docker-runc | Mar 17, 2026 | Mar 17, 2026 |
| Huawei Euleros 2_0_sp12 | — | Upgrade docker-runc | Mar 17, 2026 | Mar 17, 2026 |
| Huawei Euleros 2_0_sp13 | — | Upgrade docker-runc | Feb 3, 2026 | Feb 2, 2026 |
| Oracle_linux | — | Upgrade netavarkUpgrade skopeoUpgrade crunUpgrade skopeo-testsUpgrade runcUpgrade udicaUpgrade libslirpUpgrade python3-podmanUpgrade podman-testsUpgrade conmonUpgrade container-selinuxUpgrade podman-pluginsUpgrade podmanUpgrade criu-develUpgrade slirp4netnsUpgrade critUpgrade libslirp-develUpgrade podman-remoteUpgrade criuUpgrade buildahUpgrade oci-seccomp-bpf-hookUpgrade podman-catatonitUpgrade fuse-overlayfsUpgrade criu-libsUpgrade containernetworking-pluginsUpgrade buildah-testsUpgrade python3-criuUpgrade podman-gvproxyUpgrade aardvark-dnsUpgrade podman-dockerUpgrade cockpit-podmanUpgrade containers-common | Nov 11, 2025 | Nov 5, 2025 |
| Redhat Openshift | — | Upgrade rhcosUpgrade buildahUpgrade runc | Aug 10, 2026 | Nov 5, 2025 |
| Redhat_linux | — | Upgrade kernelUpgrade kernel-rt | Nov 14, 2025 | Nov 5, 2025 |
| Rocky_linux | — | Upgrade podman-gvproxy-debuginfoUpgrade podman-pluginsUpgrade python3-criuUpgrade toolbox-debuginfoUpgrade crunUpgrade podman-debuginfoUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade containernetworking-pluginsUpgrade slirp4netns-debugsourceUpgrade podman-catatonitUpgrade podman-tests-debuginfoUpgrade containernetworking-plugins-debuginfoUpgrade critUpgrade conmon-debuginfoUpgrade criuUpgrade podman-plugins-debuginfoUpgrade libslirp-debugsourceUpgrade podman-debugsourceUpgrade criu-libs-debuginfoUpgrade toolbox-testsUpgrade slirp4netns-debuginfoUpgrade libslirp-debuginfoUpgrade criu-develUpgrade podmanUpgrade podman-remoteUpgrade runcUpgrade skopeo-testsUpgrade podman-testsUpgrade toolbox-debugsourceUpgrade podman-gvproxyUpgrade fuse-overlayfs-debugsourceUpgrade fuse-overlayfs-debuginfoUpgrade conmon-debugsourceUpgrade buildah-debugsourceUpgrade runc-debugsourceUpgrade buildah-debuginfoUpgrade buildahUpgrade containernetworking-plugins-debugsourceUpgrade libslirpUpgrade fuse-overlayfsUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade crun-debuginfoUpgrade oci-seccomp-bpf-hookUpgrade criu-debuginfoUpgrade slirp4netnsUpgrade netavarkUpgrade crun-debugsourceUpgrade buildah-testsUpgrade toolboxUpgrade podman-remote-debuginfoUpgrade aardvark-dnsUpgrade skopeoUpgrade podman-catatonit-debuginfoUpgrade criu-libsUpgrade buildah-tests-debuginfoUpgrade criu-debugsourceUpgrade conmonUpgrade libslirp-develUpgrade containers-commonUpgrade runc-debuginfo | Feb 5, 2026 | Dec 18, 2025 |
| Suse | — | Upgrade runcUpgrade podmanshUpgrade podman-remoteUpgrade podman-dockerUpgrade podmanUpgrade buildah | Dec 5, 2025 | Nov 11, 2025 |
| Ubuntu | — | Upgrade runc-stableUpgrade runc | Nov 6, 2025 | Nov 5, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Feb 9, 2026 | Nov 6, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub