CVE-2026-84042 Overview
CVE-2026-84042 is a privilege escalation flaw in crun, the OCI container runtime written in C. When crun is built with libkrun support and a container is launched rootful with passt networking enabled through krun.use_passt, the runtime can execute attacker-controlled payloads from the container image with host root privileges. The issue is a regression introduced in crun 1.29 and affects all versions from crun >= 1.29. Exploitation allows a malicious container image to break the isolation boundary and gain full control of the host system. The vulnerability is tracked under [CWE-269: Improper Privilege Management].
Critical Impact
A crafted container image executed with libkrun and passt networking can run code as host root, breaking container isolation and compromising the underlying host.
Affected Products
- crun version 1.29 and later, when built with libkrun support
- Container platforms using crun as the OCI runtime with krun.use_passt enabled
- Rootful container deployments leveraging passt networking through libkrun
Discovery Timeline
- 2026-09-10 - CVE-2026-84042 published to the National Vulnerability Database (NVD)
- 2026-09-10 - Last updated in NVD database
Technical Details for CVE-2026-84042
Vulnerability Analysis
The flaw resides in the code path that crun executes when starting a rootful container with libkrun and passt networking. libkrun is a dynamic library that enables the launch of KVM-based virtualized workloads, while passt provides user-mode networking. When the krun.use_passt annotation is set, crun invokes logic that trusts inputs originating from the container image without adequate privilege separation.
Because crun runs with host root privileges in the rootful configuration, any payload it invokes inherits those privileges. The regression allows an attacker who supplies the container image, or who can influence its contents, to have code executed in the host root context rather than being confined inside the container or virtual machine boundary.
Root Cause
The root cause is improper privilege management [CWE-269] introduced in crun 1.29. The passt-integration path added or modified in that release fails to drop privileges or validate that executable content sourced from the container image is not run in the host security context. Earlier versions of crun did not exhibit this behavior, confirming the regression.
Attack Vector
The attack vector is local. An adversary must be able to supply a container image or influence container startup on a host where crun is built with libkrun and the container is configured with krun.use_passt. Once these conditions are met, starting the container triggers execution of attacker-controlled content as root on the host. Attack complexity is elevated because the exploit requires a specific build option, rootful execution, and the passt networking annotation to be set.
No public proof-of-concept exploit is currently listed for CVE-2026-84042. See the Red Hat CVE-2026-84042 Advisory and Red Hat Bug Report #2531222 for technical details.
Stop Remote Code Execution Before It Runs
Singularity™ Endpoint detects and blocks exploit attempts at machine speed, including zero-days and novel attack techniques.
Stop Exploit AttemptsDetection Methods for CVE-2026-84042
Indicators of Compromise
- Container configurations or OCI annotations containing krun.use_passt on hosts running crun 1.29 or later built with libkrun.
- Unexpected root-owned processes spawned by crun on the host immediately following container startup.
- Container images from untrusted registries being pulled and launched with libkrun-backed runtimes.
Detection Strategies
- Inventory hosts to identify installations of crun version 1.29 or newer that were compiled with libkrun support.
- Audit container manifests and pod specifications for the krun.use_passt annotation on rootful workloads.
- Correlate container lifecycle events with process creation telemetry to flag executables launched by crun that run outside expected container namespaces.
Monitoring Recommendations
- Enable process execution auditing (for example, Linux auditd rules on execve) for the crun binary and its child processes.
- Alert on container startups that combine libkrun-based runtimes with passt networking on production hosts.
- Monitor container registries and image supply chains for unsigned or unverified images used in libkrun deployments.
How to Mitigate CVE-2026-84042
Immediate Actions Required
- Identify all hosts where crun was compiled with libkrun support and inventory workloads using the krun.use_passt annotation.
- Upgrade crun to a fixed version once released by your Linux distribution vendor; consult the Red Hat CVE-2026-84042 Advisory for package updates.
- Restrict which users and service accounts may launch rootful containers with libkrun on affected hosts.
- Only run trusted, signed container images on hosts that meet the vulnerable configuration until patches are applied.
Patch Information
Refer to the Red Hat CVE-2026-84042 Advisory for the fixed package versions distributed by your operating system vendor. Upstream fixes will be published in the GitHub crun Repository. Because the regression was introduced in crun 1.29, any patched release must be equal to or later than the version shipped by the vendor with the fix backported.
Workarounds
- Disable the krun.use_passt annotation on rootful containers until a patched crun is installed.
- Run affected workloads rootless, or with a non-libkrun runtime, on impacted hosts.
- Rebuild crun without libkrun support if libkrun functionality is not required in your environment.
- Enforce image provenance controls so that only signed, trusted container images can be executed on hosts running the affected configuration.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
