CVE-2026-88265— Crun: crun: /dev/null symlink follow during stdio reopen allows host bind-mount write and chown
Quick assessment
Affected
Red Hat Red Hat Hardened Images
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 crun 中发现了一个缺陷。在 操作后，重新打开 作为标准输入/输出流时，可能会跟随符号链接，从而将宿主机的某个文件连接到容器的标准输入/输出流，并更改该文件的所有权。受影响的版本为 crun 1.29.1 及更早版本。在挂载全新 的默认配置下，该问题不会暴露。目前尚无修复版本发布。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-88265
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Crun: crun: /dev/null symlink follow during stdio reopen allows host bind-mount write and chown
Source: CVE Program / CVE List V5
Vulnerability Description
A flaw was found in crun. After pivot_root, reopening /dev/null for stdio can follow a symlink and attach a host file to container stdio, then change that file's ownership. Affected versions are crun 1.29.1 and earlier. Default configurations that mount a fresh /dev are not exposed. No fixed release is available yet.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在文件访问前对链接解析不恰当(链接跟随)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Red Hat | Red Hat Hardened Images | - |
cpe:/a:redhat:hummingbird:1
|
|
II. Public POCs for CVE-2026-88265
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-88265
请登录查看更多情报信息。
Other References for CVE-2026-88265 (3)
Same Patch Batch · Red Hat · 2026-09-10 · 5 CVEs total
| CVE-2026-84042 | 7.8 HIGH | Crun: crun: rootful krun with passt executes container payload as host root |
| CVE-2026-88770 | 6.5 MEDIUM | Keycloak-services: keycloak-services: device authorization grant issues tokens to brute-fo |
| CVE-2026-88763 | 5.9 MEDIUM | Skupper-router: skupper-router: unbounded recursion in amqp field parser leads to denial o |
| CVE-2026-88264 | 5.6 MEDIUM | Crun: crun: /dev/console symlink follow allows root-owned file creation outside the rootfs |
IV. Related Vulnerabilities
Same product: Red Hat Hardened Images
-
CVE-2026-88264
Crun: crun: /dev/console symlink follow allows root-owned fi -
CVE-2026-84042
Crun: crun: rootful krun with passt executes container paylo -
CVE-2026-74860
Libxml2: double-free/uaf in libxml2 python bindings -
CVE-2026-78409
Util-linux: util-linux: x-mount.subdir detached-tree resolut -
CVE-2026-78408
Util-linux: util-linux: nsenter --join-cgroup leaks root cgr
Same vendor: Red Hat
-
CVE-2026-88264
Crun: crun: /dev/console symlink follow allows root-owned fi -
CVE-2026-84042
Crun: crun: rootful krun with passt executes container paylo -
CVE-2026-88770
Keycloak-services: keycloak-services: device authorization g -
CVE-2026-88763
Skupper-router: skupper-router: unbounded recursion in amqp -
CVE-2026-18147
Freeipa: ipa: freeipa/idm: cross-site scripting vulnerabilit
Same weakness: CWE-59
-
CVE-2026-88264
Crun: crun: /dev/console symlink follow allows root-owned fi -
CVE-2026-87766
Bubblewrap: bubblewrap: symlink traversal via /oldroot allow -
CVE-2026-78622
Improper Link Resolution in Okta Verify for Windows Uninstal -
CVE-2026-81963
Windows Update Stack Elevation of Privilege Vulnerability -
CVE-2026-69425
Windows NTFS Tampering Vulnerability
V. Comments for CVE-2026-88265
No comments yet