runc is a CLI tool for spawning and running containers according to the OCI specification. In versions 1.2.7, 1.3.2 and 1.4.0-rc.2, an attacker can trick runc into misdirecting writes to /proc to other procfs files through the use of a racing container with shared mounts (we have also verified this attack is possible to exploit using a standard Dockerfile with docker buildx build as that also permits triggering parallel execution of containers with custom shared mounts configured). This redirect could be through symbolic links in a tmpfs or theoretically other methods such as regular bind-mounts. While similar, the mitigation applied for the related CVE, CVE-2019-19921, was fairly limited and effectively only caused runc to verify that when LSM labels are written they are actually procfs files. This issue is fixed in versions 1.2.8, 1.3.3, and 1.4.0-rc.3.
CVSS Details
- CVSS 4.0 Base Score: 7.3 (HIGH)
- CVSS 4.0 Vector: (CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade toolbox-testsUpgrade criu-develUpgrade python3-podmanUpgrade toolboxUpgrade crunUpgrade podman-gvproxyUpgrade skopeo-testsUpgrade conmonUpgrade cockpit-podmanUpgrade netavarkUpgrade libslirpUpgrade podman-testsUpgrade buildah-testsUpgrade slirp4netnsUpgrade podman-dockerUpgrade podman-pluginsUpgrade buildahUpgrade udicaUpgrade containernetworking-pluginsUpgrade container-selinuxUpgrade podman-remoteUpgrade containers-commonUpgrade libslirp-develUpgrade criuUpgrade runcUpgrade skopeoUpgrade oci-seccomp-bpf-hookUpgrade python3-criuUpgrade fuse-overlayfsUpgrade podman-catatonitUpgrade aardvark-dnsUpgrade criu-libsUpgrade critUpgrade podman | Nov 11, 2025 | Nov 7, 2025 |
| Alpine Linux | — | Upgrade buildahUpgrade podmanUpgrade runc | Nov 7, 2025 | Nov 6, 2025 |
| Amazon Linux Ami 2 | — | Upgrade runcUpgrade runc-debuginfo | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade runcUpgrade runc-debuginfoUpgrade runc-debugsource | Nov 7, 2025 | Nov 5, 2025 |
| Arista Eos | — | Upgrade to a fixed EOS release. | Apr 29, 2026 | Apr 7, 2026 |
| Dell Powerstore Dsa2026115 | — | Upgrade Dell PowerStoreOS to the latest version | Feb 25, 2026 | Feb 24, 2026 |
| Huawei Euleros 2_0_sp10 | — | Upgrade docker-runc | Mar 17, 2026 | Mar 17, 2026 |
| Huawei Euleros 2_0_sp11 | — | Upgrade docker-runc | Mar 17, 2026 | Mar 17, 2026 |
| Huawei Euleros 2_0_sp12 | — | Upgrade docker-runc | Mar 17, 2026 | Mar 17, 2026 |
| Huawei Euleros 2_0_sp13 | — | Upgrade docker-runc | Feb 3, 2026 | Feb 2, 2026 |
| Oracle_linux | — | Upgrade python3-podmanUpgrade skopeo-testsUpgrade podman-testsUpgrade conmonUpgrade libslirpUpgrade runcUpgrade container-selinuxUpgrade slirp4netnsUpgrade critUpgrade skopeoUpgrade netavarkUpgrade udicaUpgrade libslirp-develUpgrade criu-develUpgrade crunUpgrade podmanUpgrade podman-pluginsUpgrade oci-seccomp-bpf-hookUpgrade python3-criuUpgrade podman-catatonitUpgrade fuse-overlayfsUpgrade criu-libsUpgrade podman-gvproxyUpgrade aardvark-dnsUpgrade cockpit-podmanUpgrade podman-dockerUpgrade criuUpgrade buildah-testsUpgrade containernetworking-pluginsUpgrade podman-remoteUpgrade buildahUpgrade containers-common | Nov 11, 2025 | Nov 5, 2025 |
| Redhat Openshift | — | Upgrade rhcosUpgrade runcUpgrade buildah | Aug 10, 2026 | Nov 5, 2025 |
| Redhat_linux | — | Upgrade kernelUpgrade kernel-rt | Nov 14, 2025 | Nov 5, 2025 |
| Rocky_linux | — | Upgrade libslirp-debuginfoUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade toolbox-debuginfoUpgrade crunUpgrade podman-catatonitUpgrade slirp4netns-debugsourceUpgrade podman-pluginsUpgrade containernetworking-pluginsUpgrade python3-criuUpgrade toolbox-testsUpgrade podman-tests-debuginfoUpgrade podman-testsUpgrade criu-libs-debuginfoUpgrade criu-develUpgrade podman-debuginfoUpgrade podman-gvproxy-debuginfoUpgrade conmon-debuginfoUpgrade critUpgrade criuUpgrade containernetworking-plugins-debuginfoUpgrade podman-debugsourceUpgrade podman-plugins-debuginfoUpgrade libslirp-debugsourceUpgrade podmanUpgrade podman-remoteUpgrade runcUpgrade skopeo-testsUpgrade toolbox-debugsourceUpgrade slirp4netns-debuginfoUpgrade criu-debuginfoUpgrade conmon-debugsourceUpgrade buildah-debugsourceUpgrade aardvark-dnsUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade slirp4netnsUpgrade crun-debuginfoUpgrade libslirp-develUpgrade fuse-overlayfsUpgrade fuse-overlayfs-debuginfoUpgrade criu-libsUpgrade buildah-tests-debuginfoUpgrade oci-seccomp-bpf-hookUpgrade runc-debugsourceUpgrade runc-debuginfoUpgrade containers-commonUpgrade buildah-debuginfoUpgrade buildahUpgrade skopeoUpgrade podman-catatonit-debuginfoUpgrade netavarkUpgrade toolboxUpgrade podman-remote-debuginfoUpgrade fuse-overlayfs-debugsourceUpgrade crun-debugsourceUpgrade buildah-testsUpgrade libslirpUpgrade conmonUpgrade criu-debugsourceUpgrade podman-gvproxyUpgrade containernetworking-plugins-debugsource | Feb 5, 2026 | Dec 18, 2025 |
| Suse | — | Upgrade runcUpgrade podman-remoteUpgrade podmanshUpgrade podman-dockerUpgrade buildahUpgrade podman | Dec 5, 2025 | Nov 11, 2025 |
| Ubuntu | — | Upgrade runcUpgrade runc-stable | Nov 6, 2025 | Nov 5, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Feb 9, 2026 | Nov 6, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub