This vulnerability arises from improper validation of environment variable entries in CRI-O's container creation process. Specifically, if the CreateContainer request's environment variables are nil, CRI-O falls back to using the OCI image's config.Env entries without verifying that each entry conforms to the 'key=value' format. An entry missing the '=' character causes CRI-O to split the string into a single-element slice and then attempt to access a second element, resulting in an out-of-range index panic. This triggers an unrecovered Go runtime panic in the crio daemon, crashing it and terminating container-runtime services on the affected node until the daemon is restarted.

The vulnerability leads to a denial of service condition on the node running CRI-O, as the crio daemon crashes and container runtime services are terminated for all workloads on that node until manual restart. There is no impact on confidentiality or integrity, but availability is severely affected. Exploitation requires local access with high privileges and no user interaction is needed. The scope of impact is changed as the crash affects the container runtime service across workloads on the node.

Patch status is not yet confirmed — check the vendor advisory at https://access.redhat.com/security/cve/CVE-2026-17113 for current remediation guidance. Until a fix is available, operators should avoid using container images with malformed environment variables lacking '=' characters. Restarting the crio daemon restores service after a crash. Monitor Red Hat advisories for updates and patches addressing this issue.