The vulnerability in crun occurs when it is built with libkrun and a container is started rootful using passt networking (krun.use_passt). This configuration allows crun to execute payloads controlled by an attacker from the container image with host root privileges. The flaw is a regression introduced in crun version 1.29 and affects all versions from 1.29 onward. The issue is tracked as CVE-2026-84042 and is associated with improper privilege management (CWE-269). The CVSS 3.1 score is 7.8, indicating high severity, with local attack vector, high attack complexity, low privileges required, no user interaction, and impacts on confidentiality, integrity, and availability. The vendor advisory from Red Hat confirms the issue and recommends mitigation by avoiding running untrusted images with krun and passt networking until a fixed version is available. No patch or fixed version is currently provided.

Successful exploitation allows an attacker to execute arbitrary code from a container image with host root privileges, potentially leading to full host compromise. The vulnerability impacts confidentiality, integrity, and availability of the host system. The flaw is a regression, meaning it was introduced in a recent version (1.29) and did not exist in prior versions. The attack requires local access with low privileges but high attack complexity and no user interaction. There are no known exploits in the wild at this time.

The vendor advisory explicitly recommends not running untrusted container images with krun and passt networking enabled until a fixed version of crun is released. No official patch or fix is currently available. Users should avoid the vulnerable configuration (rootful containers with passt networking) or use alternative container runtimes until a fix is provided.