Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-123876— Podman: containers-common: containers-common: default seccomp af_vsock/netlink_audit deny rules bypassable via 32-bit truncation

Quick assessment

Affected
Red Hat Red Hat Enterprise Linux 10
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在通过 使用的 Podman 默认 seccomp 配置文件中发现了一个漏洞。针对 和 的拒绝规则在比较 socket 参数时，使用了未屏蔽的 64 位相等性检查。由于内核会将这些整型参数截断为 32 位，攻击者可通过设置高位比特来绕过这些拒绝规则。

CVSS 4.4 · Medium

Possible ATT&CK Techniques 2 AI

T1055 · Process Injection T1068.004

Affected Version Matrix 10

VendorProduct Version RangeStatus
Red Hat Red Hat Enterprise Linux 10 any affected
Red Hat Red Hat Enterprise Linux 8 any affected
Red Hat Red Hat Enterprise Linux 9 any affected
Red Hat Red Hat Hardened Images any unaffected
any affected
any unaffected
Red Hat Red Hat OpenShift Container Platform 4 any affected
any affected
any affected
Red Hat Red Hat OpenShift Container Platform 5 any affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-123876

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Podman: containers-common: containers-common: default seccomp af_vsock/netlink_audit deny rules bypassable via 32-bit truncation
Source: CVE Program / CVE List V5
Vulnerability Description
A flaw was found in the default seccomp profile used by Podman via containers-common. Deny rules for AF_VSOCK and NETLINK_AUDIT compared socket arguments with unmasked 64-bit equality. Because the kernel truncates those int arguments to 32 bits, setting upper bits can bypass the deny rules.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
不完整的黑名单
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Red Hat Red Hat Enterprise Linux 10 - cpe:/a:redhat:enterprise_linux:10
Red Hat Red Hat Enterprise Linux 8 - cpe:/a:redhat:enterprise_linux:8
Red Hat Red Hat Enterprise Linux 9 - cpe:/a:redhat:enterprise_linux:9
Red Hat Red Hat Hardened Images - cpe:/a:redhat:hummingbird:1
Red Hat Red Hat Hardened Images - cpe:/a:redhat:hummingbird:1
Red Hat Red Hat Hardened Images - cpe:/a:redhat:hummingbird:1
Red Hat Red Hat OpenShift Container Platform 4 - cpe:/a:redhat:openshift:4
Red Hat Red Hat OpenShift Container Platform 4 - cpe:/a:redhat:openshift:4
Red Hat Red Hat OpenShift Container Platform 4 - cpe:/a:redhat:openshift:4
Red Hat Red Hat OpenShift Container Platform 5 - cpe:/a:redhat:openshift:5

II. Public POCs for CVE-2026-123876

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-123876

请登录查看更多情报信息。

Other References for CVE-2026-123876 (5)

Same Patch Batch · Red Hat · 2026-11-06 · 16 CVEs total

CVE-2026-109081 6.8 MEDIUM Keycloak-services: keycloak-services: injection of roles into realm default-roles via dcr
CVE-2026-19688 6.8 MEDIUM Keycloak-services: keycloak-services: admin api missing audience check
CVE-2026-123037 6.7 MEDIUM Ansible-core: user module generate_ssh_key follows a symlinked ~/.ssh enabling local privi
CVE-2026-96547 6.5 MEDIUM Keycloak-services: keycloak-services: dcr registration-time claim-path gap allows forging
CVE-2026-97848 6.5 MEDIUM Keycloak-services: keycloak-services: protocol mapper with jsontype=json bypasses token sa
CVE-2026-9797 6.5 MEDIUM Keycloak: keycloak: privilege escalation via client authentication manipulation by an auth
CVE-2026-107124 6.4 MEDIUM Keycloak-services: keycloak-services: oidc logout endpoint session fixation via id_token_h
CVE-2026-97367 6.4 MEDIUM Keycloak-services: keycloak-services: dcr azp and sid claim substitution allows account re
CVE-2026-120749 6.2 MEDIUM Dbus: dbus-daemon: dbus-daemon aborts (reply_serial != 0) when a broadcast from the driver
CVE-2026-96460 5.4 MEDIUM Keycloak-services: keycloak-services: indefinite access token renewal via standard token e
CVE-2026-92856 4.9 MEDIUM Keycloak-services: keycloak-services: saml broker ignores proxyrestriction delegation cons
CVE-2026-121837 4.3 MEDIUM Quarkus-rest-data-panache: quarkus-rest-data-panache: getter-level @securefield ignored fo
CVE-2026-96447 4.2 MEDIUM Keycloak-services: keycloak-services: stateless token preferred_username fallback enables
CVE-2026-83493 Distributed-workloads: github actions pinned by mutable tag/branch, including third-party
CVE-2026-83494 Training-operator: pytorchjob validateupdate casts oldjob from newobj, bypassing managedby

IV. Related Vulnerabilities

Same product: Red Hat Enterprise Linux 10
Same vendor: Red Hat
Same weakness: CWE-184