CVE-2026-88265 is a moderate severity vulnerability in crun where, after the pivot_root operation, reopening /dev/null for standard input/output can follow a symbolic link. This behavior allows a container process with low privileges to attach a host bind-mounted file to the container's stdio and change the ownership of that file. Exploitation requires a malicious container image that replaces /dev/null with a symlink and the absence of a mounted fresh /dev inside the container. The flaw is classified under CWE-59 (Improper Link Resolution Before File Access). No official fix or patch is currently available for affected versions 1.29.1 and earlier. Default container configurations that mount a fresh /dev are not exposed to this issue.

An attacker with low privileges inside a container can write to and change ownership of a host bind-mounted file by exploiting the symlink following behavior of /dev/null reopening after pivot_root. This can lead to unauthorized modification of host files from within the container. There is no impact on confidentiality or availability, but the integrity of host files can be compromised. Exploitation requires specific conditions, including a malicious container image and particular container configurations.

No official fix or patch is currently available for this vulnerability. Mitigation options are limited and do not meet Red Hat's criteria for ease of use, applicability, or stability. Default container configurations that mount a fresh /dev are not vulnerable. Users should avoid running containers with configurations that do not mount a fresh /dev or allow /dev/null to be replaced by a symlink. Monitor vendor advisories for updates and fixes.