Description
containerd is a container runtime. A time-of-check to time-of-use (TOCTOU) vulnerability was found in containerd v2.1.0. While unpacking an image during an image pull, specially crafted container images could arbitrarily modify the host file system. The only affected version of containerd is 2.1.0. Other versions of containerd are not affected. This bug has been fixed in containerd 2.1.1. Users should update to this version to resolve the issue. As a workaround, ensure that only trusted images are used and that only trusted users have permissions to import images.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| containerd | containerd | = 2.1.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | govulncheck-vulndb | 0.0.20250523T151856-1.1 | openSUSE-SU-2025:15159-1 |
| openSUSE Tumbleweed | kind | 0.29.0-1.1 | openSUSE-SU-2025:15146-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | containerd | 2.1.1-r0 | — |
| Alpine v3.23 | containerd | 2.1.1-r0 | — |
| Alpine v3.22 | containerd | 2.1.1-r0 | — |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | docker-compose | 2.36.2-r0 | — |
| Wolfi rolling | neuvector-scanner +2 | 3.813-r0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/containerd/containerd/v2 | >= 2.1.0, < 2.1.1 | 2.1.1 | GHSA-cm76-qm8v-3j95 |
Advisories 2
- openSUSE-SU-2025:15159-1 govulncheck-vulndb-0.0.20250523T151856-1.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
- openSUSE-SU-2025:15146-1 kind-0.29.0-1.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026