CVE-2026-41579
published 2026-07-01CVE-2026-41579: runc is a CLI tool for spawning and running containers according to the OCI specification. In versions prior to 1.3.6, 1.4.0-rc.1, 1.4.0-rc.12, 1.5.0-rc.1, and…
PriorityP417low3.3CVSS 3.1
AVLACLPRNUIRSUCNILAN
EPSS
0.19%
7.8th percentile
runc is a CLI tool for spawning and running containers according to the OCI specification. In versions prior to 1.3.6, 1.4.0-rc.1, 1.4.0-rc.12, 1.5.0-rc.1, and 1.5.0-rc.1, when setting up the container rootfs, setupPtmx and setupDevSymlinks call os.Remove and os.Symlink with a filepath.Join string which allow an image with /dev as a symlink to trick runc into deleting files called ptmx on the host or creating a hardcoded set of symlinks with specific names and targets in an arbitrary pre-existing host directory. This issue is not exploitable under Docker, because Docker creates a top-level read-only layer that masks any malicious /dev symlink present in the container image — unlike some other Linux container tooling, whose higher-level runtimes built on runc remain exposed to exploitation via a malicious image. This issue has been fixed in versions 1.3.6, 1.4.3 and 1.5.0.
Affected
12 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| container-tools_rhel8 | runc | — | — |
| github.com | opencontainers_runc | >= 0 < 1.3.6 | 1.3.6 |
| github.com | opencontainers_runc | >= 1.4.0 < 1.4.3 | 1.4.3 |
| github.com | opencontainers_runc | >= 1.5.0-rc.1 < 1.5.0-rc.3 | 1.5.0-rc.3 |
| linuxfoundation | runc | < 1.3.6 | 1.3.6 |
| linuxfoundation | runc | — | — |
| linuxfoundation | runc | — | — |
| linuxfoundation | runc | >= 1.4.0 < 1.4.3 | 1.4.3 |
| opencontainers | runc | < 1.3.6 | 1.3.6 |
| opencontainers | runc | — | — |
| opencontainers | runc | — | — |
| opencontainers | runc | — | — |
CVSS provenance
nvdv3.13.3LOWCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
vendor_redhat3.3LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
runc: runc: Host filesystem integrity compromised by malicious container images
vendor_redhat·2026-07-01·CVSS 3.3
CVE-2026-41579 [LOW] CWE-22 runc: runc: Host filesystem integrity compromised by malicious container images
runc: runc: Host filesystem integrity compromised by malicious container images
runc is a CLI tool for spawning and running containers according to the OCI specification. In versions prior to 1.3.6, 1.4.0-rc.1, 1.4.0-rc.12, 1.5.0-rc.1, and 1.5.0-rc.1, when setting up the container rootfs, setupPtmx and setupDevSymlinks call os.Remove and os.Symlink with a filepath.Join string which allow an image with /dev as a symlink to trick runc into deleting files called ptmx on the host or creating a hardcoded set of symlinks with specific names and targets in an arbitrary pre-existing host directory. This issue is not exploitable under Docker, because Docker creates a top-level read-only layer that masks any malicious /dev symlink present in the container image — unlike some other Linux container t
GHSA
runc: Malicious image with /dev symlink can trigger limited host filesystem integrity violations
ghsa·2026-06-22
CVE-2026-41579 [MEDIUM] CWE-61 runc: Malicious image with /dev symlink can trigger limited host filesystem integrity violations
runc: Malicious image with /dev symlink can trigger limited host filesystem integrity violations
### Impact
When setting up the container rootfs, `setupPtmx` and `setupDevSymlinks` call `os.Remove` and `os.Symlink` with a `filepath.Join` string which allow an image with `/dev` as a symlink to trick runc into deleting files called `ptmx` on the host or creating a hardcoded set of symlinks with specific names and targets in an arbitrary pre-existing host directory.
Please note that this issue is not exploitable under Docker because [it creates a top-level `ro` layer that masks any malicious `/dev` symlink present in the container image](https://github.com/moby/moby/blob/docker-v29.4.1/daemon/initlayer/setup_unix.go) (this is also done without mounting the lower layers so there is no opport
No detection rules found.
No public exploits indexed.
2026-07-01
Published