CVE-2026-41579

A flaw was found in runc, a tool used to run containers. A malicious container image, crafted with a specific type of symbolic link in its /dev directory, can deceive runc. This deception could lead to the deletion of certain files or the creation of predefined symbolic links on the host system where the container is running. This vulnerability, known as Improper Neutralization of Special Elements used in a Path (CWE-61), primarily affects container runtimes like Podman and containerd that utilize runc, potentially compromising the integrity of the host's filesystem.

On Red Hat Enterprise Linux and Red Hat CoreOS, this issue is reachable through higher-level runtimes that use runc without Docker’s read-only layer masking (for example Podman on RHEL and CRI-O on RHCOS). Red Hat scores this as a Low impact integrity issue: a malicious image that is run can cause only limited host filesystem changes (deletion of files named ptmx, or creation of a fixed set of symlinks). SELinux in enforcing mode and user-namespace/rootless configurations may further reduce practical impact but are not treated as a complete fix.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Run only trusted images.Prefer rootless or user-namespace configurations where practical, and keep SELinux in enforcing mode so host filesystem impact is further limited. These steps reduce exposure but do not fully eliminate the flaw; upgrade to a fixed runc release as soon as it is available.