Red Hat: CVE-2025-52881: runc: opencontainers/selinux: container escape and denial of service due to arbitrary write gadgets and procfs write redirects (Multiple Advisories)

A flaw was found in runc. This attack is a more sophisticated variant of CVE-2019-16884, which was a flaw that allowed an attacker to trick runc into writing the LSM process labels for a container process into a dummy tmpfs file and thus not apply the correct LSM labels to the container process. The mitigation applied for CVE-2019-16884 was fairly limited and effectively only caused runc to verify that when we write LSM labels that those labels are actual procfs files.