Threats affecting pkg:github/containers/crun

CVE-2026-84042 is a high-severity vulnerability in crun affecting versions 1.29 and later. When crun is built with libkrun and a container is started rootful with passt networking enabled (krun.use_passt), it allows execution of attacker-controlled payloads from the container image with host root privileges. This is a regression introduced in version 1.29 due to improper privilege management, resulting in privilege escalation to host root. Mitigation currently involves avoiding running untrusted container images with krun and passt networking until a fixed version is released.

A vulnerability in crun versions 1.29.1 and earlier allows reopening /dev/null for stdio after pivot_root to follow a symlink, potentially attaching a host file to container stdio and changing its ownership. Default configurations that mount a fresh /dev are not affected. No fixed release was initially available, but Red Hat has released an update in crun 1.30-1.hum1 addressing this issue.

A vulnerability (CVE-2026-88264) was found in crun where, if the container configuration does not assign a dedicated mount for /dev, terminal setup can redirect /dev/console onto an unintended device. This flaw can lead to a scenario where integrity of the container environment is compromised. The issue affects multiple versions of crun up to 1.29.1 and several specific older versions. A security update including crun version 1.30-1.hum1 has been released by Red Hat to address this issue.

CVE-2026-47766 is a vulnerability in crun, an open source OCI Container Runtime written in C. Prior to version 1.28, crun's default device setup opens the container root filesystem's /dev directory without the O_NOFOLLOW flag. This allows crun to follow symbolic links in the rootfs/dev directory, potentially creating device nodes and symlinks outside the container rootfs. This behavior can overwrite existing files such as ptmx. The issue is fixed in crun version 1.28.