Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-09-10T00:00:00 crun: crun: /dev/console symlink follow allows root-owned file creation outside the rootfs 5.6 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:N CWE-59

A flaw was found in crun. When the container configuration does not give /dev a dedicated mount, terminal setup can redirect /dev/console onto an attacker-controlled path, including via the read-only-rootfs bind-mount fallback. Affected versions are crun 1.29.1 and earlier. Default configurations that mount a fresh /dev are not exposed. No fixed release is available yet.

A flaw was found in crun. When the container configuration does not give /dev a dedicated mount, terminal setup can redirect /dev/console onto an attacker-controlled path, including via the read-only-rootfs bind-mount fallback. Affected versions are crun 1.29.1 and earlier. Default configurations that mount a fresh /dev are not exposed. No fixed release is available yet.

Exploitation requires an OCI configuration that does not mount /dev, plus a malicious image. Supported Red Hat container tooling mounts /dev by default. Red Hat products are not affected in supported configurations. Always mount /dev (Podman/crun default). Do not run untrusted images with a /dev-less config. Red Hat Enterprise Linux 10 Fix deferred crun Red Hat Enterprise Linux 8 Fix deferred container-tools:rhel8/crun Red Hat Enterprise Linux 9 Fix deferred crun Red Hat Hardened Images Affected crun Red Hat OpenShift Container Platform 4 Fix deferred crun Red Hat OpenShift Container Platform 4 Fix deferred openshift/ose-rhel-coreos-8 Red Hat OpenShift Container Platform 4 Fix deferred openshift/ose-rhel-coreos-9 https://www.cve.org/CVERecord?id=CVE-2026-88264 https://nvd.nist.gov/vuln/detail/CVE-2026-88264 https://github.com/containers/crun/