CVE-2026-88264
crun: crun: /dev/console symlink follow allows root-owned file creation outside the rootfs
Severity
ModerateRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · September 10, 2026
Updated · September 26, 2026
Description
A flaw was found in crun. When the container configuration does not give /dev a dedicated mount, terminal setup can redirect /dev/console onto an attacker-controlled path, including via the read-only-rootfs bind-mount fallback. Affected versions are crun 1.29.1 and earlier. Default configurations that mount a fresh /dev are not exposed. No fixed release is available yet.
Statement
Exploitation requires an OCI configuration that does not mount /dev, plus a malicious image. Supported Red Hat container tooling mounts /dev by default. Red Hat products are not affected in supported configurations.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
Always mount /dev (Podman/crun default). Do not run untrusted images with a /dev-less config.
CVSS / CWE
CVSS 3.1 · 5.6CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:N
CWE-59 · Improper Link Resolution Before File Access ('Link Following')