CVE-2026-88264: crun Path Traversal Vulnerability

CVE-2026-88264 Overview

A flaw in crun, the OCI container runtime used by Podman and other container tooling, allows terminal setup to redirect /dev/console onto an attacker-controlled path. The issue occurs when a container configuration does not give /dev a dedicated mount. The redirection can also be triggered through the read-only-rootfs bind-mount fallback. Affected releases include crun 1.29.1 and earlier. Default configurations that mount a fresh /dev inside the container are not exposed to this flaw. The vulnerability is tracked as a link-following weakness [CWE-59].

Critical Impact
A local attacker with permission to launch containers can influence host filesystem targets through /dev/console redirection, resulting in high integrity impact with scope change.

Affected Products

crun container runtime, versions 1.29.1 and earlier
Container platforms depending on crun (for example, Podman deployments)
Environments running containers without a dedicated /dev mount

Discovery Timeline

2026-09-10 - CVE CVE-2026-88264 published to NVD
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-88264

Vulnerability Analysis

The flaw resides in how crun performs terminal setup for containers. During initialization, the runtime prepares /dev/console inside the container. When the container configuration does not provide a dedicated mount for /dev, the runtime resolves /dev/console against paths that an attacker can influence. This is a classic link-following weakness [CWE-59] where the runtime follows a symbolic link or bind-mount target outside the intended container namespace.

Because the terminal setup path also participates in the read-only-rootfs bind-mount fallback, a crafted configuration or rootfs layout can steer the console setup to write or bind onto an attacker-chosen path. The scope change reflected in the vector indicates that impact crosses the container boundary. Confidentiality and availability are not directly affected, but integrity of resources reachable by the runtime process is at risk.

Root Cause

The root cause is unsafe path resolution during /dev/console preparation when /dev is not mounted as a fresh, dedicated filesystem inside the container. The runtime does not sufficiently validate that the resolved target remains inside the container's expected /dev directory before performing the bind operation. This enables symlink or bind-mount redirection to attacker-controlled locations [CWE-59].

Attack Vector

Exploitation requires local access and the ability to influence the container configuration or rootfs contents. The attacker crafts a container that omits a dedicated /dev mount and stages a symbolic link or bind-mount arrangement that causes crun to route the /dev/console setup onto a target of choice. Attack complexity is high because the attacker must control specific configuration properties and win the runtime path-resolution behavior. See the Red Hat CVE-2026-88264 Advisory for additional context.

No verified exploit code is public. Refer to the Red Hat advisory
and the crun project repository for authoritative technical details.

Detection Methods for CVE-2026-88264

Indicators of Compromise

Container specifications (config.json) that omit an explicit tmpfs or devtmpfs mount at /dev
Unexpected symbolic links inside container rootfs pointing from dev/console to host paths
Bind-mount operations from crun targeting paths outside the container's rootfs during startup

Detection Strategies

Audit OCI runtime specifications for containers missing a dedicated /dev mount and flag them for review
Monitor mount and openat syscalls performed by crun during container start for targets that resolve outside the container rootfs
Track version inventory to identify hosts still running crun 1.29.1 or earlier

Monitoring Recommendations

Enable auditd or eBPF-based telemetry on container hosts to record crun process activity, including terminal and bind-mount syscalls
Alert on container launches originating from non-privileged users that reference custom rootfs layouts
Correlate container runtime logs with filesystem modifications on the host outside expected container storage paths

How to Mitigate CVE-2026-88264

Immediate Actions Required

Inventory all systems running crun and identify versions 1.29.1 and earlier
Ensure container configurations mount a fresh /dev (typically tmpfs) so that the vulnerable code path is not reached
Restrict which users and services may launch containers with custom OCI specifications

Patch Information

No fixed release of crun is available yet at the time of publication. Track the GitHub crun Project Repository and the Red Hat Bug Report #2531223 for updates. Apply distribution security updates as soon as vendors publish fixed packages.

Workarounds

Configure all containers to mount a dedicated /dev filesystem so the vulnerable fallback path is not triggered
Avoid deploying containers with read-only rootfs configurations that rely on the bind-mount fallback for /dev/console until a patch is available
Limit container launch privileges to trusted users to reduce local exploitability

bash

# Ensure a fresh /dev tmpfs mount in the OCI runtime spec
# Example fragment for config.json under "mounts":
#   {
#     "destination": "/dev",
#     "type": "tmpfs",
#     "source": "tmpfs",
#     "options": ["nosuid", "strictatime", "mode=755", "size=65536k"]
#   }

# Verify installed crun version
crun --version