The runC tool, a lightweight container runtime implementation, contains several security flaws that allow container escape and denial of service. Specifically, CVE-2025-31133 involves container escape via 'masked path' abuse due to mount race conditions. CVE-2025-52565 allows container escape with malicious configuration exploiting /dev/console mount races. CVE-2025-52881 enables container escape and denial of service through arbitrary write gadgets and procfs write redirects. Additionally, CVE-2025-65637 in the github.com/sirupsen/logrus logging library causes denial of service via large single-line payloads. Red Hat has issued an update for runC version 1.2.9-1.el9_2.1 to fix these vulnerabilities in Red Hat Enterprise Linux 9.2 and related distributions.

Successful exploitation of these vulnerabilities could allow an attacker to escape container isolation, potentially gaining unauthorized access to the host system or other containers. Denial-of-service conditions could also be triggered, impacting availability of containerized services. These issues affect container runtime security and could compromise the integrity and availability of containerized workloads on affected Red Hat Enterprise Linux 9.2 systems.

Red Hat has released an official security update for runC in Red Hat Enterprise Linux 9.2 (version 1.2.9-1.el9_2.1) that addresses these vulnerabilities. Users should apply this update promptly following Red Hat's published guidance at https://access.redhat.com/articles/11258 to remediate the issues. No additional mitigations are specified beyond applying the official patch.