The runC tool, a lightweight container runtime implementation of the Open Container Format, contains multiple security flaws that enable container escape and denial of service. CVE-2025-31133 involves container escape via 'masked path' abuse exploiting mount race conditions. CVE-2025-52565 allows container escape through malicious container configuration involving /dev/console mounts and related race conditions. CVE-2025-52881 permits container escape and denial of service through arbitrary write gadgets and procfs write redirects. These vulnerabilities affect Red Hat Enterprise Linux 9 and related distributions. Red Hat has issued an update to fix these issues as detailed in advisory RHSA-2025:19927.

Successful exploitation of these vulnerabilities could allow a malicious container to escape its isolation boundary, potentially gaining unauthorized access to the host system or causing denial of service. This compromises container security and could affect the integrity and availability of containerized workloads on affected Red Hat Enterprise Linux 9 systems.

Red Hat has released security updates for runC in Red Hat Enterprise Linux 9 to address these vulnerabilities. Users should apply the updates as described in Red Hat advisory RHSA-2025:19927 and the referenced article https://access.redhat.com/articles/11258. The advisory indicates the update is rated as Important and provides fixed package versions. Applying these official patches is the recommended remediation. No alternative mitigations or workarounds are specified in the advisory.