The runC tool, a lightweight container runtime implementation, contains three security vulnerabilities: CVE-2025-31133 involves container escape via 'masked path' abuse due to mount race conditions; CVE-2025-52565 allows container escape through malicious configuration exploiting /dev/console mount and related race conditions; CVE-2025-52881 enables container escape and denial of service through arbitrary write gadgets and procfs write redirects. These vulnerabilities affect multiple architectures of Red Hat Enterprise Linux 9. Red Hat has issued an important security advisory (RHSA-2025:20957) with updated packages to fix these issues.

Successful exploitation of these vulnerabilities could allow a containerized process to escape its container isolation, potentially gaining unauthorized access to the host system or causing denial of service. This compromises container security boundaries and may affect system integrity and availability. The issues are rated as important by Red Hat, indicating a high security impact but not necessarily critical.

Red Hat has released updated runC packages addressing these vulnerabilities. Users of affected Red Hat Enterprise Linux 9 versions should apply the security updates as detailed in Red Hat Advisory RHSA-2025:20957 and the associated article https://access.redhat.com/articles/11258. Applying these official patches is the recommended remediation. No additional vendor advisories indicate that no action is required or that the issues are already mitigated. Patch status is confirmed as available via the vendor advisory.