Skip to content
Sign in
5.6 Medium

CVE-2026-88265 Crun: crun: /dev/null symlink follow during stdio reopen allows host bind-mount write and chown

Description

A flaw was found in crun. After pivot_root, reopening /dev/null for stdio can follow a symlink and attach a host file to container stdio, then change that file's ownership. Affected versions are crun 1.29.1 and earlier. Default configurations that mount a fresh /dev are not exposed. No fixed release is available yet.

CVSS 3.1 detail

Vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:N

Exploitable with local access to the machine, with an ordinary account and without any user action; an attacker can seriously compromise confidentiality, integrity or availability.

Attack vector
Local
Attack complexity
High
Privileges required
Low
Interaction
None
Scope
Changed
Confidentiality
None
Integrity
High
Availability
None

Affected products and versions

Product Affected versions Fixed in
Red Hat Hardened Images 1.30 earliest → < 1.30-1.hum1 1.30-1.hum1
Red Hat Enterprise Linux 10 Versions not published
Red Hat Enterprise Linux 8 Versions not published
Red Hat Enterprise Linux 9 Versions not published
Red Hat OpenShift Container Platform 4 Versions not published
Red Hat OpenShift Container Platform 5 Versions not published

Other CVEs of Red Hat Hardened Images

The 380 CVEs of Red Hat Hardened Images →
CVE-2026-120749 Dbus: dbus-daemon: dbus-daemon aborts (reply_serial != 0) when a broadcast from the driver cannot be delivered to a monitored bus 6.2 Medium CVE-2026-111253 Dnf5daemon-server: dnf5: dnf5daemon-server: missing session-owner check allows foreign d-bus callers to replace another client's resolved transaction 6.6 Medium CVE-2026-123151 Gdb: gdb: stack buffer overflow in parse_tsv_definition via stale rs->buf tail Not rated CVE-2026-121997 Gdb: gdbserver: heap buffer overflow in cmd_qtdpsrc via qtdpsrc declared/actual length mismatch 8.1 High
Track this CVE