runc is a CLI tool for spawning and running containers according to the OCI specification. In versions 1.2.7, 1.3.2 and 1.4.0-rc.2, an attacker can trick runc into misdirecting writes to /proc to other procfs files through the use of a racing container with shared mounts (we have also verified this attack is possible to exploit using a standard Dockerfile with docker buildx build as that also permits triggering parallel execution of containers with custom shared mounts configured). This redirect could be through symbolic links in a tmpfs or theoretically other methods such as regular bind-mounts. While similar, the mitigation applied for the related CVE, CVE-2019-19921, was fairly limited and effectively only caused runc to verify that when LSM labels are written they are actually procfs files. This issue is fixed in versions 1.2.8, 1.3.3, and 1.4.0-rc.3.
CVSS Details
- CVSS 4.0 Base Score: 7.3 (HIGH)
- CVSS 4.0 Vector: (CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade crunUpgrade libslirpUpgrade podman-pluginsUpgrade podman-testsUpgrade slirp4netnsUpgrade cockpit-podmanUpgrade toolbox-testsUpgrade buildah-testsUpgrade toolboxUpgrade criu-develUpgrade python3-podmanUpgrade podman-gvproxyUpgrade skopeo-testsUpgrade netavarkUpgrade podman-dockerUpgrade conmonUpgrade criu-libsUpgrade containers-commonUpgrade udicaUpgrade podmanUpgrade podman-remoteUpgrade critUpgrade containernetworking-pluginsUpgrade podman-catatonitUpgrade container-selinuxUpgrade buildahUpgrade criuUpgrade libslirp-develUpgrade fuse-overlayfsUpgrade runcUpgrade skopeoUpgrade oci-seccomp-bpf-hookUpgrade python3-criuUpgrade aardvark-dns | Nov 11, 2025 | Nov 7, 2025 |
| Alpine Linux | — | Upgrade podmanUpgrade runcUpgrade buildah | Nov 7, 2025 | Nov 6, 2025 |
| Amazon Linux Ami 2 | — | Upgrade runcUpgrade runc-debuginfo | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade runc-debuginfoUpgrade runc-debugsourceUpgrade runc | Nov 7, 2025 | Nov 5, 2025 |
| Arista Eos | — | Upgrade to a fixed EOS release. | Apr 29, 2026 | Apr 7, 2026 |
| Dell Powerstore Dsa2026115 | — | Upgrade Dell PowerStoreOS to the latest version | Feb 25, 2026 | Feb 24, 2026 |
| Huawei Euleros 2_0_sp10 | — | Upgrade docker-runc | Mar 17, 2026 | Mar 17, 2026 |
| Huawei Euleros 2_0_sp11 | — | Upgrade docker-runc | Mar 17, 2026 | Mar 17, 2026 |
| Huawei Euleros 2_0_sp12 | — | Upgrade docker-runc | Mar 17, 2026 | Mar 17, 2026 |
| Huawei Euleros 2_0_sp13 | — | Upgrade docker-runc | Feb 3, 2026 | Feb 2, 2026 |
| Oracle_linux | — | Upgrade aardvark-dnsUpgrade python3-criuUpgrade buildah-testsUpgrade podman-dockerUpgrade criuUpgrade criu-libsUpgrade oci-seccomp-bpf-hookUpgrade cockpit-podmanUpgrade podman-gvproxyUpgrade buildahUpgrade containernetworking-pluginsUpgrade fuse-overlayfsUpgrade containers-commonUpgrade podman-catatonitUpgrade podman-remoteUpgrade runcUpgrade container-selinuxUpgrade podmanUpgrade conmonUpgrade podman-pluginsUpgrade python3-podmanUpgrade libslirp-develUpgrade critUpgrade skopeo-testsUpgrade crunUpgrade criu-develUpgrade podman-testsUpgrade skopeoUpgrade netavarkUpgrade udicaUpgrade slirp4netnsUpgrade libslirp | Nov 11, 2025 | Nov 5, 2025 |
| Redhat Openshift | — | Upgrade buildahUpgrade ose-rhel-coreosUpgrade runc | Aug 10, 2026 | Nov 5, 2025 |
| Redhat_linux | — | Upgrade kernel-rtUpgrade kernel | Nov 14, 2025 | Nov 5, 2025 |
| Rocky_linux | — | Upgrade buildahUpgrade conmonUpgrade containers-commonUpgrade buildah-debuginfoUpgrade runc-debuginfoUpgrade fuse-overlayfs-debuginfoUpgrade libslirpUpgrade criu-libsUpgrade oci-seccomp-bpf-hookUpgrade buildah-tests-debuginfoUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade criu-debuginfoUpgrade skopeoUpgrade aardvark-dnsUpgrade conmon-debugsourceUpgrade buildah-debugsourceUpgrade crun-debuginfoUpgrade fuse-overlayfsUpgrade podman-gvproxyUpgrade netavarkUpgrade libslirp-develUpgrade containernetworking-plugins-debugsourceUpgrade podman-catatonit-debuginfoUpgrade runc-debugsourceUpgrade criu-debugsourceUpgrade crun-debugsourceUpgrade fuse-overlayfs-debugsourceUpgrade podman-remote-debuginfoUpgrade toolboxUpgrade buildah-testsUpgrade slirp4netnsUpgrade podman-testsUpgrade toolbox-debuginfoUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade slirp4netns-debugsourceUpgrade libslirp-debugsourceUpgrade podman-tests-debuginfoUpgrade podman-debugsourceUpgrade podman-catatonitUpgrade crunUpgrade libslirp-debuginfoUpgrade podmanUpgrade toolbox-debugsourceUpgrade slirp4netns-debuginfoUpgrade skopeo-testsUpgrade runcUpgrade podman-remoteUpgrade podman-pluginsUpgrade podman-gvproxy-debuginfoUpgrade criu-libs-debuginfoUpgrade containernetworking-pluginsUpgrade python3-criuUpgrade podman-debuginfoUpgrade criuUpgrade toolbox-testsUpgrade podman-plugins-debuginfoUpgrade critUpgrade containernetworking-plugins-debuginfoUpgrade conmon-debuginfoUpgrade criu-devel | Feb 5, 2026 | Dec 18, 2025 |
| Suse | — | Upgrade podmanUpgrade buildahUpgrade podman-dockerUpgrade runcUpgrade podman-remoteUpgrade podmansh | Dec 5, 2025 | Nov 11, 2025 |
| Ubuntu | — | Upgrade runcUpgrade runc-stable | Nov 6, 2025 | Nov 5, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Feb 9, 2026 | Nov 6, 2025 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub