Skip to content
OpenAdvisories
High ELSA-2025-21702 1 CVE

Important: podman security update (Oracle Linux 9)

Published Nov 25, 2025 · Updated Nov 25, 2025

Summary

[5.6.0-7.0.1]
- Add devices on container startup, not on creation
- overlay: Put should ignore ENINVAL for Unmount [Orabug: 36234694]
- Drop nmap-ncat requirement and skip ignore-socket test case [Orabug: 34117404]

[6:5.6.0-7]
- update to the latest content of https://github.com/containers/podman/tree/v5.6-rhel
(https://github.com/containers/podman/commit/2791007)
- fixes '[Minor Incident] CVE-2025-52881 podman: container escape and denial of service due to arbitrary write gadgets and procfs write redirects [rhel-9.7.z]'
- Resolves: RHEL-126913

[6:5.6.0-6]
- update to the latest content of https://github.com/containers/podman/tree/v5.6-rhel
(https://github.com/containers/podman/commit/61231e1)
- fixes 'Timeouts while pushing Sigstore logs to Rekor - [RHEL 9.7] 0day'
- Resolves: RHEL-111076

[6:5.6.0-5]
- rebuild as last build was built in the wrong tag
- Related: RHEL-110317

[6:5.6.0-4]
- update to the latest content of https://github.com/containers/podman/tree/v5.6-rhel
(https://github.com/containers/podman/commit/c5a3735)
- fixes 'Can not find network create and rm message from podman event when set --events-backend to journald - [RHEL 9.7] 0day'
- Resolves: RHEL-110317

[6:5.6.0-3]
- update to the latest content of https://github.com/containers/podman/tree/v5.6-rhel
(https://github.com/containers/podman/commit/7078b79)
- fixes 'CVE-2025-9566 podman: Podman kube play command may overwrite host files [rhel-9.7]'
- Resolves: RHEL-113151

Fixed packages 5

ReleasePackageFixed in
Oracle Linux · 9 podman 6:5.6.0-7.0.1.el9_7
Oracle Linux · 9 podman-docker 6:5.6.0-7.0.1.el9_7
Oracle Linux · 9 podman-plugins 6:5.6.0-7.0.1.el9_7
Oracle Linux · 9 podman-remote 6:5.6.0-7.0.1.el9_7
Oracle Linux · 9 podman-tests 6:5.6.0-7.0.1.el9_7

Vulnerabilities 1

  • High 7.3
    CVE-2025-52881 Public exploit

    runc: LSM labels can be bypassed with malicious config using dummy procfs files

    runc is a CLI tool for spawning and running containers according to the OCI specification. In versions 1.2.7, 1.3.2 and 1.4.0-rc.2, an attacker can trick runc into misdirecting writes to /proc to other procfs files through the use of a racing container with s…