CVE-2026-88264 is a vulnerability in crun where, if the container configuration lacks a dedicated /dev mount, terminal setup can redirect /dev/console to an attacker-controlled path, including through the read-only-rootfs bind-mount fallback. This can allow an attacker to create root-owned files outside the container root filesystem by following symlinks improperly (CWE-59). The flaw affects crun versions 1.29.1 and earlier. Exploitation requires local access with a low privilege level and a malicious container image, combined with a container configuration that does not mount /dev. Default configurations that mount a fresh /dev are not exposed. Red Hat's supported container tooling mounts /dev by default, mitigating exposure. No official fix or patched release is available yet.

The vulnerability allows an attacker with local low-privilege access and a malicious container image to redirect /dev/console to an attacker-controlled path, potentially enabling unauthorized file creation outside the container root filesystem. This can lead to integrity violations by modifying files or bypassing protection mechanisms. Confidentiality and availability impacts are not indicated. Exploitation requires specific container configuration conditions that are not default in supported Red Hat products.

No fixed release is currently available. The vendor recommends always mounting /dev in container configurations, which is the default in Podman and crun. Avoid running untrusted container images with configurations that do not mount /dev. Supported Red Hat container tooling mounts /dev by default and is not affected in supported configurations. Users should verify their container configurations to ensure /dev is mounted to mitigate this vulnerability.