CVE-2026-88264— Crun: crun: /dev/console symlink follow allows root-owned file creation outside the rootfs
Quick assessment
Affected
Red Hat Red Hat Hardened Images
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 crun 中发现了一个缺陷。当容器配置未为 指定独立挂载时，终端设置（terminal setup）可能将 重定向到由攻击者控制的路径，包括通过只读根文件系统（read-only-rootfs）的 bind-mount 回退机制。受影响的版本为 crun 1.29.1 及更早版本。默认配置中挂载全新 的情况不受影响。目前尚无已发布的修复版本。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-88264
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Crun: crun: /dev/console symlink follow allows root-owned file creation outside the rootfs
Source: CVE Program / CVE List V5
Vulnerability Description
A flaw was found in crun. When the container configuration does not give /dev a dedicated mount, terminal setup can redirect /dev/console onto an attacker-controlled path, including via the read-only-rootfs bind-mount fallback. Affected versions are crun 1.29.1 and earlier. Default configurations that mount a fresh /dev are not exposed. No fixed release is available yet.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在文件访问前对链接解析不恰当(链接跟随)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Red Hat | Red Hat Hardened Images | - |
cpe:/a:redhat:hummingbird:1
|
|
II. Public POCs for CVE-2026-88264
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-88264
请登录查看更多情报信息。
Other References for CVE-2026-88264 (3)
Same Patch Batch · Red Hat · 2026-09-10 · 5 CVEs total
| CVE-2026-84042 | 7.8 HIGH | Crun: crun: rootful krun with passt executes container payload as host root |
| CVE-2026-88770 | 6.5 MEDIUM | Keycloak-services: keycloak-services: device authorization grant issues tokens to brute-fo |
| CVE-2026-88763 | 5.9 MEDIUM | Skupper-router: skupper-router: unbounded recursion in amqp field parser leads to denial o |
| CVE-2026-88265 | 5.6 MEDIUM | Crun: crun: /dev/null symlink follow during stdio reopen allows host bind-mount write and |
IV. Related Vulnerabilities
Same product: Red Hat Hardened Images
-
CVE-2026-88265
Crun: crun: /dev/null symlink follow during stdio reopen all -
CVE-2026-84042
Crun: crun: rootful krun with passt executes container paylo -
CVE-2026-74860
Libxml2: double-free/uaf in libxml2 python bindings -
CVE-2026-78409
Util-linux: util-linux: x-mount.subdir detached-tree resolut -
CVE-2026-78408
Util-linux: util-linux: nsenter --join-cgroup leaks root cgr
Same vendor: Red Hat
-
CVE-2026-88265
Crun: crun: /dev/null symlink follow during stdio reopen all -
CVE-2026-84042
Crun: crun: rootful krun with passt executes container paylo -
CVE-2026-88770
Keycloak-services: keycloak-services: device authorization g -
CVE-2026-88763
Skupper-router: skupper-router: unbounded recursion in amqp -
CVE-2026-18147
Freeipa: ipa: freeipa/idm: cross-site scripting vulnerabilit
Same weakness: CWE-59
-
CVE-2026-88265
Crun: crun: /dev/null symlink follow during stdio reopen all -
CVE-2026-87766
Bubblewrap: bubblewrap: symlink traversal via /oldroot allow -
CVE-2026-78622
Improper Link Resolution in Okta Verify for Windows Uninstal -
CVE-2026-81963
Windows Update Stack Elevation of Privilege Vulnerability -
CVE-2026-69425
Windows NTFS Tampering Vulnerability
V. Comments for CVE-2026-88264
No comments yet