CVE-2025-31133 — runc container escape via "masked path" abuse due to mount race conditions

Description

runc is a CLI tool for spawning and running containers according to the OCI specification. In versions 1.2.7 and below, 1.3.0-rc.1 through 1.3.1, 1.4.0-rc.1 and 1.4.0-rc.2 files, runc would not perform sufficient verification that the source of the bind-mount (i.e., the container's /dev/null) was actually a real /dev/null inode when using the container's /dev/null to mask. This exposes two methods of attack: an arbitrary mount gadget, leading to host information disclosure, host denial of service, container escape, or a bypassing of maskedPaths. This issue is fixed in versions 1.2.8, 1.3.3 and 1.4.0-rc.3.

Affected products

Vendor	Product	Affected	Fixed
opencontainers	runc	< 1.2.8, >= 1.3.0-rc.1, < 1.3.3, >= 1.4.0-rc.1, <= 1.4.0-rc.3	—

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 14	runc	1.3.3+ds1-2	—
Debian 13	runc	No fix yet	—
Debian 12	runc	No fix yet	—

Ubuntu

Security tracker ↗

Release	Package	Fixed in	Advisory
Ubuntu 25.10	runc	No fix yet	—
Ubuntu 25.10	runc-app +1	1.3.3-0ubuntu1~25.10.2	USN-7851-1
Ubuntu 24.04 LTS	runc	No fix yet	—
Ubuntu 24.04 LTS	runc-app	1.3.3-0ubuntu1~24.04.2	USN-7851-1
Ubuntu 22.04 LTS	runc	No fix yet	—
Ubuntu 22.04 LTS	runc-app	1.3.3-0ubuntu1~22.04.2	USN-7851-1
Ubuntu 20.04 LTS	runc +1	No fix yet	—

Show 2 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
Ubuntu Pro 18.04 LTS	runc	No fix yet	—
Ubuntu Pro 16.04 LTS	runc	No fix yet	—

Red Hat

Security tracker ↗

Release	Package	Fixed in	Advisory
RHEL 9	runc	4:1.2.5-3.el9_6	RHSA-2025:20957, RHSA-2025:19927
RHEL 8	aardvark-dns	2:1.10.1-2.module+el8.10.0+23647+cfd78660	RHSA-2025:21232
RHEL 8	buildah +1	2:1.33.12-2.module+el8.10.0+23647+cfd78660	RHSA-2025:21232
RHEL 8	cockpit-podman	84.1-1.module+el8.10.0+23647+cfd78660	RHSA-2025:21232
RHEL 8	conmon	3:2.1.10-1.module+el8.10.0+23647+cfd78660	RHSA-2025:21232
RHEL 8	container-selinux	2:2.229.0-2.module+el8.10.0+23647+cfd78660	RHSA-2025:21232
RHEL 8	containernetworking-plugins	1:1.4.0-6.module+el8.10.0+23647+cfd78660	RHSA-2025:21232
RHEL 8	containers-common	2:1-82.module+el8.10.0+23647+cfd78660	RHSA-2025:21232
RHEL 8	crit +4	3.18-5.module+el8.10.0+23647+cfd78660	RHSA-2025:21232
RHEL 8	crun	1.14.3-2.module+el8.10.0+23647+cfd78660	RHSA-2025:21232
RHEL 8	fuse-overlayfs	1.13-1.module+el8.10.0+23647+cfd78660	RHSA-2025:21232
RHEL 8	libslirp +1	4.4.0-2.module+el8.10.0+23647+cfd78660	RHSA-2025:21232
RHEL 8	netavark	2:1.10.3-1.module+el8.10.0+23647+cfd78660	RHSA-2025:21232
RHEL 8	oci-seccomp-bpf-hook	1.2.10-1.module+el8.10.0+23647+cfd78660	RHSA-2025:21232
RHEL 8	podman +6	4:4.9.4-23.module+el8.10.0+23647+cfd78660	RHSA-2025:21232
RHEL 8	python-podman +1	4.9.0-3.module+el8.10.0+23647+cfd78660	RHSA-2025:21232
RHEL 8	runc	4:1.2.5-2.module+el8.10.0+23647+cfd78660	RHSA-2025:21232
RHEL 8	skopeo +1	2:1.14.5-4.module+el8.10.0+23647+cfd78660	RHSA-2025:21232
RHEL 8	slirp4netns	1.2.3-1.module+el8.10.0+23647+cfd78660	RHSA-2025:21232
RHEL 8	toolbox +1	0.0.99.5-2.module+el8.10.0+23647+cfd78660	RHSA-2025:21232
RHEL 8	udica	0.2.6-21.module+el8.10.0+23647+cfd78660	RHSA-2025:21232

Show 10 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
RHEL 9.4 EUS	runc	4:1.2.9-1.el9_4	RHSA-2026:0425
RHEL 9.2 E4S	runc	4:1.2.9-1.el9_2.1	RHSA-2026:4531
RHEL 9.0 E4S	buildah +1	1:1.26.9-1.el9_0.3	RHSA-2026:8325
RHEL 9.0 E4S	podman +6	2:4.2.0-6.el9_0.6	RHSA-2026:8325
RHEL 9.0 E4S	runc	4:1.2.9-1.el9_0	RHSA-2026:8325
RHEL 9.0 E4S	skopeo +1	2:1.8.0-4.1.el9_0.2	RHSA-2026:8325
RHEL 8.8 TUS	aardvark-dns	2:1.5.0-2.module+el8.8.0+23884+2031fc78	RHSA-2026:4693
RHEL 8.8 TUS	buildah +1	1:1.29.7-1.module+el8.8.0+24026+ca15dd94	RHSA-2026:4693
RHEL 8.8 TUS	cockpit-podman	63.1-1.module+el8.8.0+23884+2031fc78	RHSA-2026:4693
RHEL 8.8 TUS	conmon	3:2.1.6-1.module+el8.8.0+23884+2031fc78	RHSA-2026:4693
RHEL 8.8 TUS	container-selinux	2:2.229.0-1.module+el8.8.0+23884+2031fc78	RHSA-2026:4693
RHEL 8.8 TUS	containernetworking-plugins	1:1.2.0-3.module+el8.8.0+23884+2031fc78	RHSA-2026:4693
RHEL 8.8 TUS	containers-common	2:1-67.module+el8.8.0+23884+2031fc78	RHSA-2026:4693
RHEL 8.8 TUS	crit +4	3.15-4.module+el8.8.0+23884+2031fc78	RHSA-2026:4693
RHEL 8.8 TUS	crun	1.14.3-1.module+el8.8.0+23884+2031fc78	RHSA-2026:4693
RHEL 8.8 TUS	fuse-overlayfs	1.11-1.module+el8.8.0+23884+2031fc78	RHSA-2026:4693
RHEL 8.8 TUS	libslirp +1	4.4.0-1.module+el8.8.0+23884+2031fc78	RHSA-2026:4693
RHEL 8.8 TUS	netavark	2:1.5.1-3.module+el8.8.0+23884+2031fc78	RHSA-2026:4693
RHEL 8.8 TUS	oci-seccomp-bpf-hook	1.2.8-1.module+el8.8.0+23884+2031fc78	RHSA-2026:4693
RHEL 8.8 TUS	podman +6	3:4.4.1-27.module+el8.8.0+24026+ca15dd94.5	RHSA-2026:4693
RHEL 8.8 TUS	python-podman +1	4.4.1-1.module+el8.8.0+23884+2031fc78	RHSA-2026:4693
RHEL 8.8 TUS	runc	1:1.2.9-1.module+el8.8.0+23884+2031fc78	RHSA-2026:4693
RHEL 8.8 TUS	skopeo +1	2:1.11.3-0.2.module+el8.8.0+23884+2031fc78	RHSA-2026:4693
RHEL 8.8 TUS	slirp4netns	1.2.0-3.module+el8.8.0+23884+2031fc78	RHSA-2026:4693
RHEL 8.8 TUS	toolbox +1	0.0.99.3-7.module+el8.8.0+23884+2031fc78	RHSA-2026:4693
RHEL 8.8 TUS	udica	0.2.6-20.module+el8.8.0+23884+2031fc78	RHSA-2026:4693
RHEL 8.8 E4S	aardvark-dns	2:1.5.0-2.module+el8.8.0+23884+2031fc78	RHSA-2026:4693
RHEL 8.8 E4S	buildah +1	1:1.29.7-1.module+el8.8.0+24026+ca15dd94	RHSA-2026:4693
RHEL 8.8 E4S	cockpit-podman	63.1-1.module+el8.8.0+23884+2031fc78	RHSA-2026:4693
RHEL 8.8 E4S	conmon	3:2.1.6-1.module+el8.8.0+23884+2031fc78	RHSA-2026:4693
RHEL 8.8 E4S	container-selinux	2:2.229.0-1.module+el8.8.0+23884+2031fc78	RHSA-2026:4693
RHEL 8.8 E4S	containernetworking-plugins	1:1.2.0-3.module+el8.8.0+23884+2031fc78	RHSA-2026:4693
RHEL 8.8 E4S	containers-common	2:1-67.module+el8.8.0+23884+2031fc78	RHSA-2026:4693
RHEL 8.8 E4S	crit +4	3.15-4.module+el8.8.0+23884+2031fc78	RHSA-2026:4693
RHEL 8.8 E4S	crun	1.14.3-1.module+el8.8.0+23884+2031fc78	RHSA-2026:4693
RHEL 8.8 E4S	fuse-overlayfs	1.11-1.module+el8.8.0+23884+2031fc78	RHSA-2026:4693
RHEL 8.8 E4S	libslirp +1	4.4.0-1.module+el8.8.0+23884+2031fc78	RHSA-2026:4693
RHEL 8.8 E4S	netavark	2:1.5.1-3.module+el8.8.0+23884+2031fc78	RHSA-2026:4693
RHEL 8.8 E4S	oci-seccomp-bpf-hook	1.2.8-1.module+el8.8.0+23884+2031fc78	RHSA-2026:4693
RHEL 8.8 E4S	podman +6	3:4.4.1-27.module+el8.8.0+24026+ca15dd94.5	RHSA-2026:4693
RHEL 8.8 E4S	python-podman +1	4.4.1-1.module+el8.8.0+23884+2031fc78	RHSA-2026:4693
RHEL 8.8 E4S	runc	1:1.2.9-1.module+el8.8.0+23884+2031fc78	RHSA-2026:4693
RHEL 8.8 E4S	skopeo +1	2:1.11.3-0.2.module+el8.8.0+23884+2031fc78	RHSA-2026:4693
RHEL 8.8 E4S	slirp4netns	1.2.0-3.module+el8.8.0+23884+2031fc78	RHSA-2026:4693
RHEL 8.8 E4S	toolbox +1	0.0.99.3-7.module+el8.8.0+23884+2031fc78	RHSA-2026:4693
RHEL 8.8 E4S	udica	0.2.6-20.module+el8.8.0+23884+2031fc78	RHSA-2026:4693
RHEL 8.6 TUS	buildah +1	1:1.26.10-1.module+el8.6.0+24209+25a14987	RHSA-2026:10703
RHEL 8.6 TUS	cockpit-podman	49.1-1.module+el8.6.0+24209+25a14987	RHSA-2026:10703
RHEL 8.6 TUS	conmon	2:2.1.4-1.module+el8.6.0+24209+25a14987	RHSA-2026:10703
RHEL 8.6 TUS	container-selinux	2:2.189.0-1.module+el8.6.0+24209+25a14987	RHSA-2026:10703
RHEL 8.6 TUS	containernetworking-plugins	1:1.1.1-5.module+el8.6.0+24209+25a14987.1	RHSA-2026:10703
RHEL 8.6 TUS	containers-common	2:1-40.module+el8.6.0+24209+25a14987	RHSA-2026:10703
RHEL 8.6 TUS	crit +4	3.15-3.module+el8.6.0+24209+25a14987	RHSA-2026:10703
RHEL 8.6 TUS	crun	1.14.3-1.module+el8.6.0+24209+25a14987	RHSA-2026:10703
RHEL 8.6 TUS	fuse-overlayfs	1.9-1.module+el8.6.0+24209+25a14987	RHSA-2026:10703
RHEL 8.6 TUS	libslirp +1	4.4.0-1.module+el8.6.0+24209+25a14987	RHSA-2026:10703
RHEL 8.6 TUS	netavark +1	2:1.0.1-40.module+el8.6.0+24209+25a14987	RHSA-2026:10703
RHEL 8.6 TUS	oci-seccomp-bpf-hook	1.2.6-1.module+el8.6.0+24215+d8cb7679.1	RHSA-2026:10703
RHEL 8.6 TUS	podman +6	2:4.2.0-8.module+el8.6.0+24209+25a14987.5	RHSA-2026:10703
RHEL 8.6 TUS	python-podman +1	4.0.1-1.module+el8.6.0+24209+25a14987	RHSA-2026:10703
RHEL 8.6 TUS	runc	1:1.2.9-1.module+el8.6.0+24209+25a14987.1	RHSA-2026:10703
RHEL 8.6 TUS	skopeo +1	2:1.9.5-1.module+el8.6.0+24224+8a7523f7.1	RHSA-2026:10703
RHEL 8.6 TUS	slirp4netns	1.2.0-3.module+el8.6.0+24209+25a14987	RHSA-2026:10703
RHEL 8.6 TUS	toolbox +1	0.0.99.3-0.7.module+el8.6.0+24209+25a14987	RHSA-2026:10703
RHEL 8.6 TUS	udica	0.2.6-5.module+el8.6.0+24209+25a14987	RHSA-2026:10703
RHEL 8.6 E4S	buildah +1	1:1.26.10-1.module+el8.6.0+24209+25a14987	RHSA-2026:10703
RHEL 8.6 E4S	cockpit-podman	49.1-1.module+el8.6.0+24209+25a14987	RHSA-2026:10703
RHEL 8.6 E4S	conmon	2:2.1.4-1.module+el8.6.0+24209+25a14987	RHSA-2026:10703
RHEL 8.6 E4S	container-selinux	2:2.189.0-1.module+el8.6.0+24209+25a14987	RHSA-2026:10703
RHEL 8.6 E4S	containernetworking-plugins	1:1.1.1-5.module+el8.6.0+24209+25a14987.1	RHSA-2026:10703
RHEL 8.6 E4S	containers-common	2:1-40.module+el8.6.0+24209+25a14987	RHSA-2026:10703
RHEL 8.6 E4S	crit +4	3.15-3.module+el8.6.0+24209+25a14987	RHSA-2026:10703
RHEL 8.6 E4S	crun	1.14.3-1.module+el8.6.0+24209+25a14987	RHSA-2026:10703
RHEL 8.6 E4S	fuse-overlayfs	1.9-1.module+el8.6.0+24209+25a14987	RHSA-2026:10703
RHEL 8.6 E4S	libslirp +1	4.4.0-1.module+el8.6.0+24209+25a14987	RHSA-2026:10703
RHEL 8.6 E4S	netavark +1	2:1.0.1-40.module+el8.6.0+24209+25a14987	RHSA-2026:10703
RHEL 8.6 E4S	oci-seccomp-bpf-hook	1.2.6-1.module+el8.6.0+24215+d8cb7679.1	RHSA-2026:10703
RHEL 8.6 E4S	podman +6	2:4.2.0-8.module+el8.6.0+24209+25a14987.5	RHSA-2026:10703
RHEL 8.6 E4S	python-podman +1	4.0.1-1.module+el8.6.0+24209+25a14987	RHSA-2026:10703
RHEL 8.6 E4S	runc	1:1.2.9-1.module+el8.6.0+24209+25a14987.1	RHSA-2026:10703
RHEL 8.6 E4S	skopeo +1	2:1.9.5-1.module+el8.6.0+24224+8a7523f7.1	RHSA-2026:10703
RHEL 8.6 E4S	slirp4netns	1.2.0-3.module+el8.6.0+24209+25a14987	RHSA-2026:10703
RHEL 8.6 E4S	toolbox +1	0.0.99.3-0.7.module+el8.6.0+24209+25a14987	RHSA-2026:10703
RHEL 8.6 E4S	udica	0.2.6-5.module+el8.6.0+24209+25a14987	RHSA-2026:10703
RHEL 8.6 AUS	buildah +1	1:1.26.10-1.module+el8.6.0+24209+25a14987	RHSA-2026:10703
RHEL 8.6 AUS	cockpit-podman	49.1-1.module+el8.6.0+24209+25a14987	RHSA-2026:10703
RHEL 8.6 AUS	conmon	2:2.1.4-1.module+el8.6.0+24209+25a14987	RHSA-2026:10703
RHEL 8.6 AUS	container-selinux	2:2.189.0-1.module+el8.6.0+24209+25a14987	RHSA-2026:10703
RHEL 8.6 AUS	containernetworking-plugins	1:1.1.1-5.module+el8.6.0+24209+25a14987.1	RHSA-2026:10703
RHEL 8.6 AUS	containers-common	2:1-40.module+el8.6.0+24209+25a14987	RHSA-2026:10703
RHEL 8.6 AUS	crit +4	3.15-3.module+el8.6.0+24209+25a14987	RHSA-2026:10703
RHEL 8.6 AUS	crun	1.14.3-1.module+el8.6.0+24209+25a14987	RHSA-2026:10703
RHEL 8.6 AUS	fuse-overlayfs	1.9-1.module+el8.6.0+24209+25a14987	RHSA-2026:10703
RHEL 8.6 AUS	libslirp +1	4.4.0-1.module+el8.6.0+24209+25a14987	RHSA-2026:10703
RHEL 8.6 AUS	netavark +1	2:1.0.1-40.module+el8.6.0+24209+25a14987	RHSA-2026:10703
RHEL 8.6 AUS	oci-seccomp-bpf-hook	1.2.6-1.module+el8.6.0+24215+d8cb7679.1	RHSA-2026:10703
RHEL 8.6 AUS	podman +6	2:4.2.0-8.module+el8.6.0+24209+25a14987.5	RHSA-2026:10703
RHEL 8.6 AUS	python-podman +1	4.0.1-1.module+el8.6.0+24209+25a14987	RHSA-2026:10703
RHEL 8.6 AUS	runc	1:1.2.9-1.module+el8.6.0+24209+25a14987.1	RHSA-2026:10703
RHEL 8.6 AUS	skopeo +1	2:1.9.5-1.module+el8.6.0+24224+8a7523f7.1	RHSA-2026:10703
RHEL 8.6 AUS	slirp4netns	1.2.0-3.module+el8.6.0+24209+25a14987	RHSA-2026:10703
RHEL 8.6 AUS	toolbox +1	0.0.99.3-0.7.module+el8.6.0+24209+25a14987	RHSA-2026:10703
RHEL 8.6 AUS	udica	0.2.6-5.module+el8.6.0+24209+25a14987	RHSA-2026:10703
Red Hat Openshift Ironic 4	python-eventlet +1	0.33.1-7.el9	RHSA-2026:1540
Red Hat OpenShift 4	bpftool	7.0.0-284.155.1.el9_2	RHSA-2026:1540
Red Hat OpenShift 4	containernetworking-plugins	1:1.4.0-5.rhaos4.14.el8	RHSA-2025:21328
Red Hat OpenShift 4	cri-o	1.27.8-16.rhaos4.14.gite1422c1.el8	RHSA-2025:21328
Red Hat OpenShift 4	cri-tools	1.27.0-7.el8	RHSA-2025:21328
Red Hat OpenShift 4	kernel-rt +21	5.14.0-284.155.1.rt14.440.el9_2	RHSA-2026:1540
Red Hat OpenShift 4	perf +60	5.14.0-284.155.1.el9_2	RHSA-2026:1540
Red Hat OpenShift 4	runc	4:1.2.5-2.rhaos4.17.el8	RHSA-2026:1540, RHSA-2026:0995, RHSA-2026:0701
Red Hat OpenShift 4	skopeo +1	2:1.11.3-5.rhaos4.14.el8	RHSA-2025:21328

AlmaLinux

Errata ↗

Release	Package	Fixed in	Advisory
AlmaLinux 9	runc	4:1.2.5-3.el9_6	ALSA-2025:20957, ALSA-2025:19927
AlmaLinux 8	aardvark-dns	2:1.10.1-2.module_el8.10.0+3909+6e1c1eb7	ALSA-2025:21232
AlmaLinux 8	buildah	2:1.33.12-2.module_el8.10.0+4016+efd18bf8	ALSA-2025:21232
AlmaLinux 8	buildah-tests	2:1.33.12-2.module_el8.10.0+4047+545787c4	ALSA-2025:21232
AlmaLinux 8	cockpit-podman	84.1-1.module_el8.10.0+4016+efd18bf8	ALSA-2025:21232
AlmaLinux 8	conmon	3:2.1.10-1.module_el8.10.0+3970+8445edf6	ALSA-2025:21232
AlmaLinux 8	container-selinux	2:2.229.0-2.module_el8.10.0+3909+6e1c1eb7	ALSA-2025:21232
AlmaLinux 8	containernetworking-plugins	1:1.4.0-6.module_el8.10.0+4016+efd18bf8	ALSA-2025:21232
AlmaLinux 8	containers-common	2:1-82.module_el8.10.0+3876+e55593a8	ALSA-2025:21232
AlmaLinux 8	crit	3.18-5.module_el8.10.0+3845+87b84552	ALSA-2025:21232
AlmaLinux 8	criu +1	3.18-5.module_el8.10.0+3876+e55593a8	ALSA-2025:21232
AlmaLinux 8	criu-devel	3.18-5.module_el8.10.0+3858+6ad51f9f	ALSA-2025:21232
AlmaLinux 8	criu-libs	3.18-5.module_el8.10.0+3909+6e1c1eb7	ALSA-2025:21232
AlmaLinux 8	crun	1.14.3-2.module_el8.10.0+3845+87b84552	ALSA-2025:21232
AlmaLinux 8	fuse-overlayfs	1.13-1.module_el8.10.0+3792+03eaed9c	ALSA-2025:21232
AlmaLinux 8	libslirp	4.4.0-2.module_el8.10.0+3845+87b84552	ALSA-2025:21232
AlmaLinux 8	libslirp-devel	4.4.0-2.module_el8.10.0+3909+6e1c1eb7	ALSA-2025:21232
AlmaLinux 8	netavark	2:1.10.3-1.module_el8.10.0+3926+f12484f5	ALSA-2025:21232
AlmaLinux 8	oci-seccomp-bpf-hook	1.2.10-1.module_el8.10.0+3909+6e1c1eb7	ALSA-2025:21232
AlmaLinux 8	podman +6	4:4.9.4-23.module_el8.10.0+4047+545787c4	ALSA-2025:21232
AlmaLinux 8	python3-podman	4.9.0-3.module_el8.10.0+4016+efd18bf8	ALSA-2025:21232
AlmaLinux 8	runc	4:1.2.5-2.module_el8.10.0+4068+0e21408f	ALSA-2025:21232
AlmaLinux 8	skopeo	2:1.14.5-4.module_el8.10.0+4047+545787c4	ALSA-2025:21232
AlmaLinux 8	skopeo-tests	2:1.14.5-4.module_el8.10.0+4016+efd18bf8	ALSA-2025:21232
AlmaLinux 8	slirp4netns	1.2.3-1.module_el8.10.0+3876+e55593a8	ALSA-2025:21232
AlmaLinux 8	toolbox	0.0.99.5-2.module_el8.10.0+3845+87b84552	ALSA-2025:21232
AlmaLinux 8	toolbox-tests	0.0.99.5-2.module_el8.10.0+3858+6ad51f9f	ALSA-2025:21232
AlmaLinux 8	udica	0.2.6-21.module_el8.10.0+4068+0e21408f	ALSA-2025:21232

Rocky Linux

Errata ↗

Release	Package	Fixed in	Advisory
Rocky Linux 9	runc	4:1.3.0-4.el9_7	RLSA-2025:20957
Rocky Linux 8	aardvark-dns	2:1.10.1-2.module+el8.10.0+1874+ce489889	RLSA-2025:21232
Rocky Linux 8	buildah	2:1.33.12-2.module+el8.10.0+2001+6a33db9f	RLSA-2025:21232
Rocky Linux 8	cockpit-podman	84.1-1.module+el8.10.0+1815+5fe7415e	RLSA-2025:21232
Rocky Linux 8	conmon	3:2.1.10-1.module+el8.10.0+1815+5fe7415e	RLSA-2025:21232
Rocky Linux 8	container-selinux	2:2.229.0-2.module+el8.10.0+1815+5fe7415e	RLSA-2025:21232
Rocky Linux 8	containernetworking-plugins	1:1.4.0-6.module+el8.10.0+2001+6a33db9f	RLSA-2025:21232
Rocky Linux 8	containers-common	2:1-82.module+el8.10.0+1843+6892ab28	RLSA-2025:21232
Rocky Linux 8	criu	3.18-5.module+el8.10.0+1815+5fe7415e	RLSA-2025:21232
Rocky Linux 8	crun	1.14.3-2.module+el8.10.0+1815+5fe7415e	RLSA-2025:21232
Rocky Linux 8	fuse-overlayfs	1.13-1.module+el8.10.0+1815+5fe7415e	RLSA-2025:21232
Rocky Linux 8	libslirp	4.4.0-2.module+el8.10.0+1815+5fe7415e	RLSA-2025:21232
Rocky Linux 8	netavark	2:1.10.3-1.module+el8.10.0+1815+5fe7415e	RLSA-2025:21232
Rocky Linux 8	oci-seccomp-bpf-hook	1.2.10-1.module+el8.10.0+1815+5fe7415e	RLSA-2025:21232
Rocky Linux 8	podman	4:4.9.4-23.module+el8.10.0+2064+309a12a4	RLSA-2025:21232
Rocky Linux 8	python-podman	4.9.0-3.module+el8.10.0+1896+b18fa106	RLSA-2025:21232
Rocky Linux 8	runc	4:1.2.5-2.module+el8.10.0+2095+5cd7f3af	RLSA-2025:21232
Rocky Linux 8	skopeo	2:1.14.5-4.module+el8.10.0+2001+6a33db9f	RLSA-2025:21232
Rocky Linux 8	slirp4netns	1.2.3-1.module+el8.10.0+1815+5fe7415e	RLSA-2025:21232
Rocky Linux 8	toolbox	0.0.99.5-2.module+el8.10.0+1815+5fe7415e.rocky.0.2.rocky.0.2	RLSA-2025:21232
Rocky Linux 8	udica	0.2.6-21.module+el8.10.0+1815+5fe7415e	RLSA-2025:21232

SUSE

Security tracker ↗

Release	Package	Fixed in	Advisory
SLES 15 SP7	alloy	1.12.2-150700.15.15.1	SUSE-SU-2026:0327-1
SLES 15 SP7	podman	4.9.5-150500.3.56.2	SUSE-SU-2025:4081-1
SLES 15 SP7	runc	1.2.7-150000.80.1	SUSE-SU-2026:3433-1, SUSE-SU-2025:4073-1, SUSE-SU-2025:3950-1
SLES 15 SP6	podman	4.9.5-150500.3.56.2	SUSE-SU-2025:4081-1
SLES 15 SP6	runc	1.2.7-150000.80.1	SUSE-SU-2025:4073-1, SUSE-SU-2025:3950-1
SLES 15 SP5	podman	4.9.5-150500.3.56.2	SUSE-SU-2025:4081-1
SLES 15 SP5	runc	1.2.7-150000.80.1	SUSE-SU-2025:4073-2, SUSE-SU-2025:3950-1
SLES 15 SP4	podman	4.9.5-150400.4.59.2	SUSE-SU-2025:4079-1
SLES 15 SP4	runc	1.2.7-150000.80.1	SUSE-SU-2025:4073-2, SUSE-SU-2025:3950-1
SLES 15 SP3	podman	4.9.5-150300.9.63.2	SUSE-SU-2025:4080-1
SLES 15 SP3	runc	1.2.7-150000.80.1	SUSE-SU-2025:4073-2, SUSE-SU-2025:3950-1

Show 18 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
SLES 12 SP5	runc	1.2.7-16.67.1	SUSE-SU-2026:3428-1, SUSE-SU-2025:4077-1, SUSE-SU-2025:3951-1
SLES for SAP 16.0	alloy	1.12.2-160000.1.1	SUSE-SU-2026:20214-1
SLES for SAP 16.0	buildah	1.39.5-160000.1.1	SUSE-SU-2026:20123-1
SLES for SAP 16.0	podman	5.4.2-160000.3.1	SUSE-SU-2026:20626-1, SUSE-SU-2026:20103-1
SLES for SAP 16.0	runc	1.3.3-160000.1.1	SUSE-SU-2026:22942-1, SUSE-SU-2025:21136-1
SLES for SAP 15 SP5	podman	4.9.5-150500.3.56.2	SUSE-SU-2025:4081-1
SLES for SAP 15 SP5	runc	1.2.7-150000.80.1	SUSE-SU-2025:4073-2, SUSE-SU-2025:3950-1
SLES for SAP 15 SP4	podman	4.9.5-150400.4.59.2	SUSE-SU-2025:4079-1
SLES for SAP 15 SP4	runc	1.2.7-150000.80.1	SUSE-SU-2025:4073-2, SUSE-SU-2025:3950-1
SLES for SAP 15 SP3	podman	4.9.5-150300.9.63.2	SUSE-SU-2025:4080-1
SLES for SAP 15 SP3	runc	1.2.7-150000.80.1	SUSE-SU-2025:4073-2, SUSE-SU-2025:3950-1
SLES 16.0	alloy	1.12.2-160000.1.1	SUSE-SU-2026:20214-1
SLES 16.0	buildah	1.39.5-160000.1.1	SUSE-SU-2026:20123-1
SLES 16.0	podman	5.4.2-160000.3.1	SUSE-SU-2026:20626-1, SUSE-SU-2026:20103-1
SLES 16.0	runc	1.3.3-160000.1.1	SUSE-SU-2026:22942-1, SUSE-SU-2025:21136-1
SLE Micro 6.2	podman	5.4.2-160000.3.1	SUSE-SU-2026:20641-1, SUSE-SU-2026:20116-1
SLE Micro 6.2	runc	1.3.3-160000.1.1	SUSE-SU-2026:22938-1, SUSE-SU-2025:21072-1
SLE Micro 6.1	runc	1.3.3-slfo.1.1_1.1	SUSE-SU-2025:21054-1
SLE Micro 6.0	podman	4.9.5-9.1	SUSE-SU-2025:21038-1
SLE Micro 6.0	runc	1.3.3-1.1	SUSE-SU-2025:21036-1
SLE Micro 5.5	podman	4.9.5-150500.3.56.2	SUSE-SU-2025:4081-1
SLE Micro 5.5	runc	1.2.7-150000.80.1	SUSE-SU-2026:3433-1, SUSE-SU-2025:4073-1, SUSE-SU-2025:3950-1
SLE Micro 5.4	podman	4.9.5-150400.4.59.2	SUSE-SU-2025:4079-1
SLE Micro 5.4	runc	1.2.7-150000.80.1	SUSE-SU-2026:3433-1, SUSE-SU-2025:4073-1, SUSE-SU-2025:3950-1
SLE Micro 5.3	podman	4.9.5-150400.4.59.2	SUSE-SU-2025:4079-1
SLE Micro 5.3	runc	1.2.7-150000.80.1	SUSE-SU-2026:3433-1, SUSE-SU-2025:4073-1, SUSE-SU-2025:3950-1
SLE Micro 5.2	podman	4.9.5-150300.9.63.2	SUSE-SU-2025:4080-1
SLE Micro 5.2	runc	1.2.7-150000.80.1	SUSE-SU-2025:4073-1, SUSE-SU-2025:3950-1
SLE Micro 5.1	podman	4.9.5-150300.9.63.2	SUSE-SU-2025:4080-1
SLE HPC 15 SP5	podman	4.9.5-150500.3.56.2	SUSE-SU-2025:4081-1
SLE HPC 15 SP5	runc	1.2.7-150000.80.1	SUSE-SU-2025:4073-2, SUSE-SU-2025:3950-1
SLE HPC 15 SP4	podman	4.9.5-150400.4.59.2	SUSE-SU-2025:4079-1
SLE HPC 15 SP4	runc	1.2.7-150000.80.1	SUSE-SU-2025:4073-2, SUSE-SU-2025:3950-1
SLE HPC 15 SP3	podman	4.9.5-150300.9.63.2	SUSE-SU-2025:4080-1
SLE HPC 15 SP3	runc	1.2.7-150000.80.1	SUSE-SU-2025:4073-2, SUSE-SU-2025:3950-1
SUSE Enterprise Storage 7.1	podman	4.9.5-150300.9.63.2	SUSE-SU-2025:4080-1
SUSE Enterprise Storage 7.1	runc	1.2.7-150000.80.1	SUSE-SU-2026:3433-1, SUSE-SU-2025:4073-1, SUSE-SU-2025:3950-1

openSUSE

Security tracker ↗

Release	Package	Fixed in	Advisory
openSUSE Tumbleweed	alloy	1.12.2-2.1	openSUSE-SU-2026:10073-1
openSUSE Tumbleweed	runc	1.3.3-1.1	openSUSE-SU-2025:15705-1
openSUSE Leap 16.0	alloy	1.12.2-160000.1.1	openSUSE-SU-2026:20140-1
openSUSE Leap 16.0	buildah	1.39.5-160000.1.1	openSUSE-SU-2026:20080-1
openSUSE Leap 16.0	govulncheck-vulndb	0.0.20260723T184607-160000.1.1	openSUSE-SU-2026:21483-1
openSUSE Leap 16.0	podman	5.4.2-160000.3.1	openSUSE-SU-2026:20305-1, openSUSE-SU-2026:20072-1
openSUSE Leap 16.0	runc	1.3.3-160000.1.1	openSUSE-SU-2026:21431-1, openSUSE-SU-2025:20072-1
openSUSE Leap 15.6	podman	4.9.5-150500.3.56.2	SUSE-SU-2025:4081-1
openSUSE Leap 15.6	runc	1.2.7-150000.80.1	SUSE-SU-2025:4073-1, SUSE-SU-2025:3950-1

Alpine

Security tracker ↗

Release	Package	Fixed in	Advisory
Alpine v3.24	runc	1.3.3-r0	—
Alpine v3.23	runc	1.3.3-r0	—
Alpine v3.22	runc	1.3.3-r0	—

Amazon Linux

Release	Package	Fixed in	Advisory
Amazon Linux 2023	runc	1.3.3-2.amzn2023.0.1	ALAS2023-2025-1286

Azure Linux

Release	Package	Fixed in	Advisory
Azure Linux 3	kubernetes	1.30.10-16	—
Azure Linux 2 (CBL-Mariner)	kubernetes	1.28.4-21	—
Azure Linux 2 (CBL-Mariner)	moby-runc	1.2.8-1	—

Oracle Linux

Release	Package	Fixed in	Advisory
Oracle Linux 9	runc	4:1.2.5-3.el9_6	ELSA-2025-20957, ELSA-2025-19927
Oracle Linux 8	aardvark-dns	2:1.10.1-2.module+el8.10.0+90704+e5ea1250	ELSA-2025-21232
Oracle Linux 8	buildah +1	2:1.33.12-2.module+el8.10.0+90704+e5ea1250	ELSA-2025-21232
Oracle Linux 8	cockpit-podman	84.1-1.module+el8.10.0+90704+e5ea1250	ELSA-2025-21232
Oracle Linux 8	conmon	3:2.1.10-1.module+el8.10.0+90704+e5ea1250	ELSA-2025-21232
Oracle Linux 8	container-selinux	2:2.229.0-2.module+el8.10.0+90704+e5ea1250	ELSA-2025-21232
Oracle Linux 8	containernetworking-plugins	1:1.4.0-6.module+el8.10.0+90704+e5ea1250	ELSA-2025-21232
Oracle Linux 8	containers-common	2:1-82.0.1.module+el8.10.0+90704+e5ea1250	ELSA-2025-21232
Oracle Linux 8	crit +4	3.18-5.module+el8.10.0+90704+e5ea1250	ELSA-2025-21232
Oracle Linux 8	crun	1.14.3-2.module+el8.10.0+90704+e5ea1250	ELSA-2025-21232
Oracle Linux 8	fuse-overlayfs	1.13-1.module+el8.10.0+90704+e5ea1250	ELSA-2025-21232
Oracle Linux 8	libslirp +1	4.4.0-2.module+el8.10.0+90704+e5ea1250	ELSA-2025-21232
Oracle Linux 8	netavark	2:1.10.3-1.module+el8.10.0+90704+e5ea1250	ELSA-2025-21232
Oracle Linux 8	oci-seccomp-bpf-hook	1.2.10-1.module+el8.10.0+90704+e5ea1250	ELSA-2025-21232
Oracle Linux 8	podman +6	4:4.9.4-23.0.1.module+el8.10.0+90704+e5ea1250	ELSA-2025-21232
Oracle Linux 8	python3-podman	4.9.0-3.module+el8.10.0+90704+e5ea1250	ELSA-2025-21232
Oracle Linux 8	runc	4:1.2.5-2.module+el8.10.0+90704+e5ea1250	ELSA-2025-21232
Oracle Linux 8	skopeo +1	2:1.14.5-4.module+el8.10.0+90704+e5ea1250	ELSA-2025-21232
Oracle Linux 8	slirp4netns	1.2.3-1.module+el8.10.0+90704+e5ea1250	ELSA-2025-21232
Oracle Linux 8	udica	0.2.6-21.module+el8.10.0+90704+e5ea1250	ELSA-2025-21232

Wolfi

Release	Package	Fixed in	Advisory
Wolfi rolling	buildah	1.42.0-r1	—
Wolfi rolling	ctop	No fix yet	—
Wolfi rolling	falco-no-driver	0.43.0-r0	—
Wolfi rolling	grafana-alloy	1.11.3-r1	—
Wolfi rolling	k3s-1.32 +2	1.32.9.1-r2	—
Wolfi rolling	kubectl-1.30 +2	1.30.14-r7	—
Wolfi rolling	node-feature-discovery-0.18	0.18.3-r1	—
Wolfi rolling	nvidia-container-toolkit-nvidia-ctk +1	1.18.1-r0	—
Wolfi rolling	podman +1	5.6.2-r3	—
Wolfi rolling	sriov-network-device-plugin +1	3.10.0-r2	—

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 3 repositories

C-h4ck-0/Learn-about-cve-2025-31133-poc ★ 2 · Jan 18, 2026

Learn about CVE-2025-31133
scherepiuk/container-escape-ebpf ★ 2 · Dec 31, 2025

POCs and Tetragon Rules for CVE-2024-21626 and CVE-2025-31133
skynet-f-nvidia/CVE-2025-31133 ★ 2 · Nov 12, 2025

CVE-2025-31133 PoC

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Affected packages

Ecosystem	Package	Affected	Fixed	Record
Go	github.com/opencontainers/runc	< 1.2.8	1.2.8	GHSA-9493-h29p-rfm2
Go	github.com/opencontainers/runc	>= 1.3.0-rc.1, < 1.3.3	1.3.3	GHSA-9493-h29p-rfm2
Go	github.com/opencontainers/runc	>= 1.4.0-rc.1, < 1.4.0-rc.3	1.4.0-rc.3	GHSA-9493-h29p-rfm2
Go	github.com/opencontainers/runc	< 1.2.8 · >= 1.3.0-rc.1, < 1.3.3 · >= 1.4.0-rc.1, < 1.4.0-rc.3	1.2.8, 1.3.3, 1.4.0-rc.3	GO-2025-4096

Advisories 50

RHBA-2025:21361 Red Hat Bug Fix Advisory: OpenShift Container Platform 4.19.19 packages update Red Hat Security Advisories (RHSA) · Nov 13, 2026
RHSA-2026:0995 Red Hat Security Advisory: OpenShift Container Platform 4.14.61 packages and security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
RHSA-2026:0676 Red Hat Security Advisory: OpenShift Container Platform 4.13.63 packages and security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
RHSA-2026:0331 Red Hat Security Advisory: OpenShift Container Platform 4.18.31 packages and security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
ALSA-2025:19927 Important: runc security update AlmaLinux Security Advisories · Oct 29, 2026
ALSA-2025:20957 Important: runc security update AlmaLinux Security Advisories · Oct 29, 2026
ALSA-2025:21232 Important: container-tools:rhel8 security update AlmaLinux Security Advisories · Oct 29, 2026
WID-SEC-2025-2518 Red Hat Enterprise Linux (runc): Mehrere Schwachstellen ermöglichen Umgehen von Sicherheitsvorkehrungen BSI CERT-Bund (WID) · Oct 26, 2026
RHSA-2026:8325 Red Hat Security Advisory: buildah, crun, podman, runc, and skopeo security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
RHSA-2026:4693 Red Hat Security Advisory: container-tools:rhel8 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
RHSA-2026:10703 Red Hat Security Advisory: container-tools:rhel8 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
RHSA-2025:21328 Red Hat Security Advisory: OpenShift Container Platform 4.14.59 packages and security update Red Hat Security Advisories (RHSA) · Oct 17, 2026
RHSA-2026:4531 Red Hat Security Advisory: runc security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
RHSA-2026:1540 Red Hat Security Advisory: OpenShift Container Platform 4.15.61 packages and security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
RHSA-2026:0701 Red Hat Security Advisory: OpenShift Container Platform 4.17.47 packages and security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
RHSA-2026:0425 Red Hat Security Advisory: runc security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
RHSA-2026:0418 Red Hat Security Advisory: OpenShift Container Platform 4.16.55 packages and security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
RHSA-2026:0315 Red Hat Security Advisory: OpenShift Container Platform 4.12.84 packages and security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
RHSA-2025:21232 Red Hat Security Advisory: container-tools:rhel8 security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
RHSA-2025:20957 Red Hat Security Advisory: runc security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
RHSA-2025:19927 Red Hat Security Advisory: runc security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
RHBA-2025:21221 Red Hat Bug Fix Advisory: OpenShift Container Platform 4.17.44 packages update Red Hat Security Advisories (RHSA) · Oct 9, 2026
WID-SEC-2026-2253 IBM Security Verify Access: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 17, 2026
openSUSE-SU-2026:21483-1 Security update for govulncheck-vulndb SUSE / openSUSE Security Updates · Jul 31, 2026
SUSE-SU-2026:3433-1 Security update for runc SUSE / openSUSE Security Updates · Jul 31, 2026
SUSE-SU-2026:3428-1 Security update for runc SUSE / openSUSE Security Updates · Jul 31, 2026
SUSE-SU-2026:22942-1 Security update for runc SUSE / openSUSE Security Updates · Jul 29, 2026
SUSE-SU-2026:22938-1 Security update for runc SUSE / openSUSE Security Updates · Jul 29, 2026
openSUSE-SU-2026:21431-1 Security update for runc SUSE / openSUSE Security Updates · Jul 24, 2026
WID-SEC-2025-2563 Microsoft Azure Linux: Mehrere Schwachstellen BSI CERT-Bund (WID) · May 11, 2026
WID-SEC-2026-0778 Dell Secure Connect Gateway Policy Manager: Mehrere Schwachstellen BSI CERT-Bund (WID) · May 11, 2026
openSUSE-SU-2026:20305-1 Security update for podman SUSE / openSUSE Security Updates · Mar 23, 2026
openSUSE-SU-2026:20140-1 Security update for alloy SUSE / openSUSE Security Updates · Mar 23, 2026
openSUSE-SU-2026:20072-1 Security update for podman SUSE / openSUSE Security Updates · Mar 23, 2026
openSUSE-SU-2026:20080-1 Security update for buildah SUSE / openSUSE Security Updates · Mar 23, 2026
openSUSE-SU-2026:10073-1 alloy-1.12.2-2.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
openSUSE-SU-2025:20072-1 Security update for runc SUSE / openSUSE Security Updates · Mar 23, 2026
openSUSE-SU-2025:15705-1 runc-1.3.3-1.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
SUSE-SU-2026:20626-1 Security update for podman SUSE / openSUSE Security Updates · Mar 23, 2026
SUSE-SU-2026:20641-1 Security update for podman SUSE / openSUSE Security Updates · Mar 23, 2026
SUSE-SU-2026:20214-1 Security update for alloy SUSE / openSUSE Security Updates · Mar 23, 2026
SUSE-SU-2026:20116-1 Security update for podman SUSE / openSUSE Security Updates · Mar 23, 2026
SUSE-SU-2026:20103-1 Security update for podman SUSE / openSUSE Security Updates · Mar 23, 2026
SUSE-SU-2026:0327-1 Security update for alloy SUSE / openSUSE Security Updates · Mar 23, 2026
SUSE-SU-2026:20123-1 Security update for buildah SUSE / openSUSE Security Updates · Mar 23, 2026
SUSE-SU-2025:4073-1 Security update for runc SUSE / openSUSE Security Updates · Mar 23, 2026
SUSE-SU-2025:4077-1 Security update for runc SUSE / openSUSE Security Updates · Mar 23, 2026
SUSE-SU-2025:3950-1 Security update for runc SUSE / openSUSE Security Updates · Mar 23, 2026
SUSE-SU-2025:3951-1 Security update for runc SUSE / openSUSE Security Updates · Mar 23, 2026
SUSE-SU-2025:21136-1 Security update for runc SUSE / openSUSE Security Updates · Mar 23, 2026

CNA	v4.0	7.3
EUVD	v4.0	7.3

runc container escape via "masked path" abuse due to mount race conditions

Description

Affected products

Fixed in Linux distributions

Debian

Ubuntu

Red Hat

AlmaLinux

Rocky Linux

SUSE

openSUSE

Alpine

Amazon Linux

Azure Linux

Oracle Linux

Wolfi

Public exploits

GitHub 3 repositories

Affected packages

Advisories 50

References