Skip to content
Fencer Intel
low 3.3

CVE-2026-41579 json

runc: Malicious image with /dev symlink can trigger limited host filesystem integrity violations

published 4mo ago modified 15d ago also GHSA-xjvp-4fhw-gc47 , GO-2026-5761 , EUVD-2026-40859

cvss
3.3
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.2%
EPSS 0.2% chance of exploitation in 30 days, percentile 8%
public exploits
0
none known

Summary

runc is a CLI tool for spawning and running containers according to the OCI specification. In versions prior to 1.3.6, 1.4.0-rc.1, 1.4.0-rc.12, 1.5.0-rc.1, and 1.5.0-rc.1, when setting up the container rootfs, setupPtmx and setupDevSymlinks call os.Remove and os.Symlink with a filepath.Join string which allow an image with /dev as a symlink to trick runc into deleting files called ptmx on the host or creating a hardcoded set of symlinks with specific names and targets in an arbitrary pre-existing host directory. This issue is not exploitable under Docker, because Docker creates a top-level read-only layer that masks any malicious /dev symlink present in the container image — unlike some other Linux container tooling, whose higher-level runtimes built on runc remain exposed to exploitation via a malicious image. This issue has been fixed in versions 1.3.6, 1.4.3 and 1.5.0.

Patch / fix

  • go github.com/opencontainers/runc 1.3.6, 1.4.3, 1.5.0-rc.3
  • linuxfoundation runc 1.3.6, 1.4.3
  • runc Debian 14 1.3.6+ds1-1

debian advisories DEBIAN-CVE-2026-41579

  • runc SLE Module for Basesystem 15 SP7, SLE Micro 5.5, SLE Micro 5.4 +12 more 1.3.6-150000.101.1
  • runc Linux Micro 6.1 1.3.6-slfo.1.1_1.1
  • runc Linux Micro 6.0 1.3.6-1.1
  • runc SLES 16.0, Linux Micro 6.2, SLES for SAP applications 16.0 1.3.6-160000.1.1
  • runc SLES LTSS Extended Security 12 SP5, SLES 12 SP5-LTSS 1.3.6-16.76.1

suse advisories SUSE-SU-2026:3433-2SUSE-SU-2026:3428-2SUSE-SU-2026:23164-1SUSE-SU-2026:23047-1SUSE-SU-2026:3433-1SUSE-SU-2026:3428-1

  • govulncheck-vulndb openSUSE Leap 16.0 0.0.20260723T184607-160000.1.1
  • runc openSUSE Leap 16.0 1.3.6-160000.1.1
  • runc openSUSE Tumbleweed 1.4.3-1.1

opensuse advisories openSUSE-SU-2026:21483-1openSUSE-SU-2026:21431-1openSUSE-SU-2026:11301-1

  • runc Alpine 3.24 1.4.3-r0

alpine advisories ALPINE-CVE-2026-41579

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • runc Azure Linux 3.0 1.3.6-1

azure linux advisories AZL-91590

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Is CVE-2026-41579 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-41579 updated cvss 3.6

runc: runc: Host filesystem integrity compromised by malicious container images

  • Red Hat Enterprise Linux 8 runc Red Hat Enterprise Linux 9 runc Red Hat OpenShift Container Platform 4 runc, openshift/ose-rhel-coreos-9 Red Hat OpenShift Container Platform 5 runc, openshift/ose-rhel-coreos-9
    affected: workaround, no fix available “Fix deferred”
  • Red Hat OpenShift Container Platform 4 openshift/ose-rhel-coreos-8
    under investigation
  • Red Hat Hardened Images podman 6.0.0-1.hum1, buildah 2:1.44.0-3.hum1
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
4mo ago

Exploit prediction

0.19% chance of exploitation in the next 30 days, higher than 8% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
CNA 3.1 3.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
GitHub 3.1 3.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Affected packages

ecosystem package affected fixed in
go github.com/opencontainers/runc
<1.3.6
>=1.4.0, <1.4.3
>=1.5.0-rc.1, <1.5.0-rc.3
1.3.6
1.4.3
1.5.0-rc.3

Affected products

  • opencontainers runc

Classification

Weakness
  • CWE-61 UNIX Symbolic Link (Symlink) Following

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.