The runC tool, a lightweight container runtime implementation, contains several security flaws that could allow container escapes and denial-of-service conditions. CVE-2025-31133 involves container escape via 'masked path' abuse due to mount race conditions. CVE-2025-52565 allows container escape through malicious configuration exploiting /dev/console mount races. CVE-2025-52881 enables container escape and denial of service via arbitrary write gadgets and procfs write redirects. Additionally, CVE-2025-65637 affects the github.com/sirupsen/logrus library, causing denial-of-service due to large single-line payloads. Red Hat has issued an update for these vulnerabilities in runc version 1.2.9-1.el9_2.1 for Red Hat Enterprise Linux 9.2 variants.

Successful exploitation of these vulnerabilities could allow an attacker to escape from a container to the host system, potentially gaining unauthorized access or causing denial-of-service conditions. The logrus vulnerability could lead to denial-of-service via crafted log payloads. These issues pose significant risks to container isolation and system stability in affected Red Hat Enterprise Linux 9.2 environments.

Red Hat has released an official security update for runc (version 1.2.9-1.el9_2.1) that addresses these vulnerabilities. Users of Red Hat Enterprise Linux 9.2 and related variants should apply this update promptly. For detailed update instructions, refer to the Red Hat advisory at https://access.redhat.com/articles/11258. No additional mitigation steps are indicated beyond applying the official patch.