Description
runc is a CLI tool for spawning and running containers according to the OCI specification. In versions 1.2.7, 1.3.2 and 1.4.0-rc.2, an attacker can trick runc into misdirecting writes to /proc to other procfs files through the use of a racing container with shared mounts (we have also verified this attack is possible to exploit using a standard Dockerfile with docker buildx build as that also permits triggering parallel execution of containers with custom shared mounts configured). This redirect could be through symbolic links in a tmpfs or theoretically other methods such as regular bind-mounts. While similar, the mitigation applied for the related CVE, CVE-2019-19921, was fairly limited and effectively only caused runc to verify that when LSM labels are written they are actually procfs files. This issue is fixed in versions 1.2.8, 1.3.3, and 1.4.0-rc.3.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| opencontainers | runc | <= 1.2.7, < 1.2.8, <= 1.3.2, < 1.3.3, <= 1.4.0-rc.2, < 1.4.0-rc.3 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | runc | 1.3.3+ds1-2 | — |
| Debian 13 | runc | No fix yet | — |
| Debian 12 | runc | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 25.10 | runc | No fix yet | — |
| Ubuntu 25.10 | runc-app +1 | 1.3.3-0ubuntu1~25.10.2 | USN-7851-1 |
| Ubuntu 24.04 LTS | runc | No fix yet | — |
| Ubuntu 24.04 LTS | runc-app | 1.3.3-0ubuntu1~24.04.2 | USN-7851-1 |
| Ubuntu 22.04 LTS | runc | No fix yet | — |
| Ubuntu 22.04 LTS | runc-app | 1.3.3-0ubuntu1~22.04.2 | USN-7851-1 |
| Ubuntu 20.04 LTS | runc +1 | No fix yet | — |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 18.04 LTS | runc | No fix yet | — |
| Ubuntu Pro 16.04 LTS | runc | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | buildah +1 | 2:1.41.6-1.el10_1 | RHSA-2025:22012 |
| RHEL 10 | podman +3 | 7:5.6.0-6.el10_1 | RHSA-2025:21220 |
| RHEL 9 | buildah +1 | 2:1.41.6-1.el9_7 | RHSA-2025:22011 |
| RHEL 9 | podman +4 | 6:5.6.0-7.el9_7 | RHSA-2025:21702 |
| RHEL 9 | runc | 4:1.2.5-3.el9_6 | RHSA-2025:20957, RHSA-2025:19927 |
| RHEL 8 | aardvark-dns | 2:1.10.1-2.module+el8.10.0+23647+cfd78660 | RHSA-2025:23543, RHSA-2025:21232 |
| RHEL 8 | buildah +1 | 2:1.33.12-2.module+el8.10.0+23647+cfd78660 | RHSA-2025:23543, RHSA-2025:21232 |
| RHEL 8 | cockpit-podman | 84.1-1.module+el8.10.0+23647+cfd78660 | RHSA-2025:23543, RHSA-2025:21232 |
| RHEL 8 | conmon | 3:2.1.10-1.module+el8.10.0+23647+cfd78660 | RHSA-2025:23543, RHSA-2025:21232 |
| RHEL 8 | container-selinux | 2:2.229.0-2.module+el8.10.0+23647+cfd78660 | RHSA-2025:23543, RHSA-2025:21232 |
| RHEL 8 | containernetworking-plugins | 1:1.4.0-6.module+el8.10.0+23647+cfd78660 | RHSA-2025:23543, RHSA-2025:21232 |
| RHEL 8 | containers-common | 2:1-82.module+el8.10.0+23647+cfd78660 | RHSA-2025:23543, RHSA-2025:21232 |
| RHEL 8 | crit +4 | 3.18-5.module+el8.10.0+23647+cfd78660 | RHSA-2025:23543, RHSA-2025:21232 |
| RHEL 8 | crun | 1.14.3-2.module+el8.10.0+23647+cfd78660 | RHSA-2025:23543, RHSA-2025:21232 |
| RHEL 8 | fuse-overlayfs | 1.13-1.module+el8.10.0+23647+cfd78660 | RHSA-2025:23543, RHSA-2025:21232 |
| RHEL 8 | libslirp +1 | 4.4.0-2.module+el8.10.0+23647+cfd78660 | RHSA-2025:23543, RHSA-2025:21232 |
| RHEL 8 | netavark | 2:1.10.3-1.module+el8.10.0+23647+cfd78660 | RHSA-2025:23543, RHSA-2025:21232 |
| RHEL 8 | oci-seccomp-bpf-hook | 1.2.10-1.module+el8.10.0+23647+cfd78660 | RHSA-2025:23543, RHSA-2025:21232 |
| RHEL 8 | podman +6 | 4:4.9.4-23.module+el8.10.0+23647+cfd78660 | RHSA-2025:23543, RHSA-2025:21232 |
| RHEL 8 | python-podman +1 | 4.9.0-3.module+el8.10.0+23647+cfd78660 | RHSA-2025:23543, RHSA-2025:21232 |
| RHEL 8 | runc | 4:1.2.5-2.module+el8.10.0+23647+cfd78660 | RHSA-2025:23543, RHSA-2025:21232 |
| RHEL 8 | skopeo +1 | 2:1.14.5-4.module+el8.10.0+23647+cfd78660 | RHSA-2025:23543, RHSA-2025:21232 |
| RHEL 8 | slirp4netns | 1.2.3-1.module+el8.10.0+23647+cfd78660 | RHSA-2025:23543, RHSA-2025:21232 |
| RHEL 8 | toolbox +1 | 0.0.99.5-2.module+el8.10.0+23647+cfd78660 | RHSA-2025:23543, RHSA-2025:21232 |
| RHEL 8 | udica | 0.2.6-21.module+el8.10.0+23647+cfd78660 | RHSA-2025:23543, RHSA-2025:21232 |
Show 12 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10.0 EUS | buildah +1 | 2:1.39.5-1.el10_0 | RHSA-2025:21633 |
| RHEL 10.0 EUS | podman +3 | 6:5.4.0-14.el10_0 | RHSA-2025:23347 |
| RHEL 9.6 EUS | buildah +1 | 2:1.39.5-1.el9_6 | RHSA-2025:21634 |
| RHEL 9.6 EUS | podman +4 | 5:5.4.0-15.el9_6 | RHSA-2025:22030 |
| RHEL 9.4 EUS | buildah +1 | 2:1.33.13-2.el9_4.1 | RHSA-2026:0426 |
| RHEL 9.4 EUS | podman +4 | 4:4.9.4-19.el9_4.5 | RHSA-2026:0424 |
| RHEL 9.4 EUS | runc | 4:1.2.9-1.el9_4 | RHSA-2026:0425 |
| RHEL 9.2 E4S | buildah +1 | 1:1.29.5-1.el9_2.2 | RHSA-2026:4532 |
| RHEL 9.2 E4S | podman +5 | 2:4.4.1-22.el9_2.5 | RHSA-2026:4533 |
| RHEL 9.2 E4S | runc | 4:1.2.9-1.el9_2.1 | RHSA-2026:4531 |
| RHEL 9.0 E4S | buildah +1 | 1:1.26.9-1.el9_0.3 | RHSA-2026:8325 |
| RHEL 9.0 E4S | podman +6 | 2:4.2.0-6.el9_0.6 | RHSA-2026:8325 |
| RHEL 9.0 E4S | runc | 4:1.2.9-1.el9_0 | RHSA-2026:8325 |
| RHEL 9.0 E4S | skopeo +1 | 2:1.8.0-4.1.el9_0.2 | RHSA-2026:8325 |
| RHEL 8.8 TUS | aardvark-dns | 2:1.5.0-2.module+el8.8.0+23884+2031fc78 | RHSA-2026:4693 |
| RHEL 8.8 TUS | buildah +1 | 1:1.29.7-1.module+el8.8.0+24026+ca15dd94 | RHSA-2026:4693 |
| RHEL 8.8 TUS | cockpit-podman | 63.1-1.module+el8.8.0+23884+2031fc78 | RHSA-2026:4693 |
| RHEL 8.8 TUS | conmon | 3:2.1.6-1.module+el8.8.0+23884+2031fc78 | RHSA-2026:4693 |
| RHEL 8.8 TUS | container-selinux | 2:2.229.0-1.module+el8.8.0+23884+2031fc78 | RHSA-2026:4693 |
| RHEL 8.8 TUS | containernetworking-plugins | 1:1.2.0-3.module+el8.8.0+23884+2031fc78 | RHSA-2026:4693 |
| RHEL 8.8 TUS | containers-common | 2:1-67.module+el8.8.0+23884+2031fc78 | RHSA-2026:4693 |
| RHEL 8.8 TUS | crit +4 | 3.15-4.module+el8.8.0+23884+2031fc78 | RHSA-2026:4693 |
| RHEL 8.8 TUS | crun | 1.14.3-1.module+el8.8.0+23884+2031fc78 | RHSA-2026:4693 |
| RHEL 8.8 TUS | fuse-overlayfs | 1.11-1.module+el8.8.0+23884+2031fc78 | RHSA-2026:4693 |
| RHEL 8.8 TUS | libslirp +1 | 4.4.0-1.module+el8.8.0+23884+2031fc78 | RHSA-2026:4693 |
| RHEL 8.8 TUS | netavark | 2:1.5.1-3.module+el8.8.0+23884+2031fc78 | RHSA-2026:4693 |
| RHEL 8.8 TUS | oci-seccomp-bpf-hook | 1.2.8-1.module+el8.8.0+23884+2031fc78 | RHSA-2026:4693 |
| RHEL 8.8 TUS | podman +6 | 3:4.4.1-27.module+el8.8.0+24026+ca15dd94.5 | RHSA-2026:4693 |
| RHEL 8.8 TUS | python-podman +1 | 4.4.1-1.module+el8.8.0+23884+2031fc78 | RHSA-2026:4693 |
| RHEL 8.8 TUS | runc | 1:1.2.9-1.module+el8.8.0+23884+2031fc78 | RHSA-2026:4693 |
| RHEL 8.8 TUS | skopeo +1 | 2:1.11.3-0.2.module+el8.8.0+23884+2031fc78 | RHSA-2026:4693 |
| RHEL 8.8 TUS | slirp4netns | 1.2.0-3.module+el8.8.0+23884+2031fc78 | RHSA-2026:4693 |
| RHEL 8.8 TUS | toolbox +1 | 0.0.99.3-7.module+el8.8.0+23884+2031fc78 | RHSA-2026:4693 |
| RHEL 8.8 TUS | udica | 0.2.6-20.module+el8.8.0+23884+2031fc78 | RHSA-2026:4693 |
| RHEL 8.8 E4S | aardvark-dns | 2:1.5.0-2.module+el8.8.0+23884+2031fc78 | RHSA-2026:4693 |
| RHEL 8.8 E4S | buildah +1 | 1:1.29.7-1.module+el8.8.0+24026+ca15dd94 | RHSA-2026:4693 |
| RHEL 8.8 E4S | cockpit-podman | 63.1-1.module+el8.8.0+23884+2031fc78 | RHSA-2026:4693 |
| RHEL 8.8 E4S | conmon | 3:2.1.6-1.module+el8.8.0+23884+2031fc78 | RHSA-2026:4693 |
| RHEL 8.8 E4S | container-selinux | 2:2.229.0-1.module+el8.8.0+23884+2031fc78 | RHSA-2026:4693 |
| RHEL 8.8 E4S | containernetworking-plugins | 1:1.2.0-3.module+el8.8.0+23884+2031fc78 | RHSA-2026:4693 |
| RHEL 8.8 E4S | containers-common | 2:1-67.module+el8.8.0+23884+2031fc78 | RHSA-2026:4693 |
| RHEL 8.8 E4S | crit +4 | 3.15-4.module+el8.8.0+23884+2031fc78 | RHSA-2026:4693 |
| RHEL 8.8 E4S | crun | 1.14.3-1.module+el8.8.0+23884+2031fc78 | RHSA-2026:4693 |
| RHEL 8.8 E4S | fuse-overlayfs | 1.11-1.module+el8.8.0+23884+2031fc78 | RHSA-2026:4693 |
| RHEL 8.8 E4S | libslirp +1 | 4.4.0-1.module+el8.8.0+23884+2031fc78 | RHSA-2026:4693 |
| RHEL 8.8 E4S | netavark | 2:1.5.1-3.module+el8.8.0+23884+2031fc78 | RHSA-2026:4693 |
| RHEL 8.8 E4S | oci-seccomp-bpf-hook | 1.2.8-1.module+el8.8.0+23884+2031fc78 | RHSA-2026:4693 |
| RHEL 8.8 E4S | podman +6 | 3:4.4.1-27.module+el8.8.0+24026+ca15dd94.5 | RHSA-2026:4693 |
| RHEL 8.8 E4S | python-podman +1 | 4.4.1-1.module+el8.8.0+23884+2031fc78 | RHSA-2026:4693 |
| RHEL 8.8 E4S | runc | 1:1.2.9-1.module+el8.8.0+23884+2031fc78 | RHSA-2026:4693 |
| RHEL 8.8 E4S | skopeo +1 | 2:1.11.3-0.2.module+el8.8.0+23884+2031fc78 | RHSA-2026:4693 |
| RHEL 8.8 E4S | slirp4netns | 1.2.0-3.module+el8.8.0+23884+2031fc78 | RHSA-2026:4693 |
| RHEL 8.8 E4S | toolbox +1 | 0.0.99.3-7.module+el8.8.0+23884+2031fc78 | RHSA-2026:4693 |
| RHEL 8.8 E4S | udica | 0.2.6-20.module+el8.8.0+23884+2031fc78 | RHSA-2026:4693 |
| RHEL 8.6 TUS | buildah +1 | 1:1.26.10-1.module+el8.6.0+24209+25a14987 | RHSA-2026:10703 |
| RHEL 8.6 TUS | cockpit-podman | 49.1-1.module+el8.6.0+24209+25a14987 | RHSA-2026:10703 |
| RHEL 8.6 TUS | conmon | 2:2.1.4-1.module+el8.6.0+24209+25a14987 | RHSA-2026:10703 |
| RHEL 8.6 TUS | container-selinux | 2:2.189.0-1.module+el8.6.0+24209+25a14987 | RHSA-2026:10703 |
| RHEL 8.6 TUS | containernetworking-plugins | 1:1.1.1-5.module+el8.6.0+24209+25a14987.1 | RHSA-2026:10703 |
| RHEL 8.6 TUS | containers-common | 2:1-40.module+el8.6.0+24209+25a14987 | RHSA-2026:10703 |
| RHEL 8.6 TUS | crit +4 | 3.15-3.module+el8.6.0+24209+25a14987 | RHSA-2026:10703 |
| RHEL 8.6 TUS | crun | 1.14.3-1.module+el8.6.0+24209+25a14987 | RHSA-2026:10703 |
| RHEL 8.6 TUS | fuse-overlayfs | 1.9-1.module+el8.6.0+24209+25a14987 | RHSA-2026:10703 |
| RHEL 8.6 TUS | libslirp +1 | 4.4.0-1.module+el8.6.0+24209+25a14987 | RHSA-2026:10703 |
| RHEL 8.6 TUS | netavark +1 | 2:1.0.1-40.module+el8.6.0+24209+25a14987 | RHSA-2026:10703 |
| RHEL 8.6 TUS | oci-seccomp-bpf-hook | 1.2.6-1.module+el8.6.0+24215+d8cb7679.1 | RHSA-2026:10703 |
| RHEL 8.6 TUS | podman +6 | 2:4.2.0-8.module+el8.6.0+24209+25a14987.5 | RHSA-2026:10703 |
| RHEL 8.6 TUS | python-podman +1 | 4.0.1-1.module+el8.6.0+24209+25a14987 | RHSA-2026:10703 |
| RHEL 8.6 TUS | runc | 1:1.2.9-1.module+el8.6.0+24209+25a14987.1 | RHSA-2026:10703 |
| RHEL 8.6 TUS | skopeo +1 | 2:1.9.5-1.module+el8.6.0+24224+8a7523f7.1 | RHSA-2026:10703 |
| RHEL 8.6 TUS | slirp4netns | 1.2.0-3.module+el8.6.0+24209+25a14987 | RHSA-2026:10703 |
| RHEL 8.6 TUS | toolbox +1 | 0.0.99.3-0.7.module+el8.6.0+24209+25a14987 | RHSA-2026:10703 |
| RHEL 8.6 TUS | udica | 0.2.6-5.module+el8.6.0+24209+25a14987 | RHSA-2026:10703 |
| RHEL 8.6 E4S | buildah +1 | 1:1.26.10-1.module+el8.6.0+24209+25a14987 | RHSA-2026:10703 |
| RHEL 8.6 E4S | cockpit-podman | 49.1-1.module+el8.6.0+24209+25a14987 | RHSA-2026:10703 |
| RHEL 8.6 E4S | conmon | 2:2.1.4-1.module+el8.6.0+24209+25a14987 | RHSA-2026:10703 |
| RHEL 8.6 E4S | container-selinux | 2:2.189.0-1.module+el8.6.0+24209+25a14987 | RHSA-2026:10703 |
| RHEL 8.6 E4S | containernetworking-plugins | 1:1.1.1-5.module+el8.6.0+24209+25a14987.1 | RHSA-2026:10703 |
| RHEL 8.6 E4S | containers-common | 2:1-40.module+el8.6.0+24209+25a14987 | RHSA-2026:10703 |
| RHEL 8.6 E4S | crit +4 | 3.15-3.module+el8.6.0+24209+25a14987 | RHSA-2026:10703 |
| RHEL 8.6 E4S | crun | 1.14.3-1.module+el8.6.0+24209+25a14987 | RHSA-2026:10703 |
| RHEL 8.6 E4S | fuse-overlayfs | 1.9-1.module+el8.6.0+24209+25a14987 | RHSA-2026:10703 |
| RHEL 8.6 E4S | libslirp +1 | 4.4.0-1.module+el8.6.0+24209+25a14987 | RHSA-2026:10703 |
| RHEL 8.6 E4S | netavark +1 | 2:1.0.1-40.module+el8.6.0+24209+25a14987 | RHSA-2026:10703 |
| RHEL 8.6 E4S | oci-seccomp-bpf-hook | 1.2.6-1.module+el8.6.0+24215+d8cb7679.1 | RHSA-2026:10703 |
| RHEL 8.6 E4S | podman +6 | 2:4.2.0-8.module+el8.6.0+24209+25a14987.5 | RHSA-2026:10703 |
| RHEL 8.6 E4S | python-podman +1 | 4.0.1-1.module+el8.6.0+24209+25a14987 | RHSA-2026:10703 |
| RHEL 8.6 E4S | runc | 1:1.2.9-1.module+el8.6.0+24209+25a14987.1 | RHSA-2026:10703 |
| RHEL 8.6 E4S | skopeo +1 | 2:1.9.5-1.module+el8.6.0+24224+8a7523f7.1 | RHSA-2026:10703 |
| RHEL 8.6 E4S | slirp4netns | 1.2.0-3.module+el8.6.0+24209+25a14987 | RHSA-2026:10703 |
| RHEL 8.6 E4S | toolbox +1 | 0.0.99.3-0.7.module+el8.6.0+24209+25a14987 | RHSA-2026:10703 |
| RHEL 8.6 E4S | udica | 0.2.6-5.module+el8.6.0+24209+25a14987 | RHSA-2026:10703 |
| RHEL 8.6 AUS | buildah +1 | 1:1.26.10-1.module+el8.6.0+24209+25a14987 | RHSA-2026:10703 |
| RHEL 8.6 AUS | cockpit-podman | 49.1-1.module+el8.6.0+24209+25a14987 | RHSA-2026:10703 |
| RHEL 8.6 AUS | conmon | 2:2.1.4-1.module+el8.6.0+24209+25a14987 | RHSA-2026:10703 |
| RHEL 8.6 AUS | container-selinux | 2:2.189.0-1.module+el8.6.0+24209+25a14987 | RHSA-2026:10703 |
| RHEL 8.6 AUS | containernetworking-plugins | 1:1.1.1-5.module+el8.6.0+24209+25a14987.1 | RHSA-2026:10703 |
| RHEL 8.6 AUS | containers-common | 2:1-40.module+el8.6.0+24209+25a14987 | RHSA-2026:10703 |
| RHEL 8.6 AUS | crit +4 | 3.15-3.module+el8.6.0+24209+25a14987 | RHSA-2026:10703 |
| RHEL 8.6 AUS | crun | 1.14.3-1.module+el8.6.0+24209+25a14987 | RHSA-2026:10703 |
| RHEL 8.6 AUS | fuse-overlayfs | 1.9-1.module+el8.6.0+24209+25a14987 | RHSA-2026:10703 |
| RHEL 8.6 AUS | libslirp +1 | 4.4.0-1.module+el8.6.0+24209+25a14987 | RHSA-2026:10703 |
| RHEL 8.6 AUS | netavark +1 | 2:1.0.1-40.module+el8.6.0+24209+25a14987 | RHSA-2026:10703 |
| RHEL 8.6 AUS | oci-seccomp-bpf-hook | 1.2.6-1.module+el8.6.0+24215+d8cb7679.1 | RHSA-2026:10703 |
| RHEL 8.6 AUS | podman +6 | 2:4.2.0-8.module+el8.6.0+24209+25a14987.5 | RHSA-2026:10703 |
| RHEL 8.6 AUS | python-podman +1 | 4.0.1-1.module+el8.6.0+24209+25a14987 | RHSA-2026:10703 |
| RHEL 8.6 AUS | runc | 1:1.2.9-1.module+el8.6.0+24209+25a14987.1 | RHSA-2026:10703 |
| RHEL 8.6 AUS | skopeo +1 | 2:1.9.5-1.module+el8.6.0+24224+8a7523f7.1 | RHSA-2026:10703 |
| RHEL 8.6 AUS | slirp4netns | 1.2.0-3.module+el8.6.0+24209+25a14987 | RHSA-2026:10703 |
| RHEL 8.6 AUS | toolbox +1 | 0.0.99.3-0.7.module+el8.6.0+24209+25a14987 | RHSA-2026:10703 |
| RHEL 8.6 AUS | udica | 0.2.6-5.module+el8.6.0+24209+25a14987 | RHSA-2026:10703 |
| Red Hat Openshift Ironic 4 | python-eventlet +1 | 0.33.1-7.el9 | RHSA-2026:1540 |
| Red Hat OpenShift 4 | bpftool | 7.0.0-284.155.1.el9_2 | RHSA-2026:1540 |
| Red Hat OpenShift 4 | buildah +1 | 2:1.33.12-2.rhaos4.18.el9 | RHSA-2026:3416, RHSA-2026:3391, RHSA-2026:2975 |
| Red Hat OpenShift 4 | containernetworking-plugins | 1:1.4.0-5.rhaos4.14.el8 | RHSA-2026:3416, RHSA-2025:21328 |
| Red Hat OpenShift 4 | cri-o | 1.27.8-16.rhaos4.14.gite1422c1.el8 | RHSA-2025:21328 |
| Red Hat OpenShift 4 | cri-tools | 1.27.0-7.el8 | RHSA-2025:21328 |
| Red Hat OpenShift 4 | kernel-rt +21 | 5.14.0-284.155.1.rt14.440.el9_2 | RHSA-2026:1540 |
| Red Hat OpenShift 4 | perf +60 | 5.14.0-284.155.1.el9_2 | RHSA-2026:1540 |
| Red Hat OpenShift 4 | runc | 4:1.2.5-2.rhaos4.17.el8 | RHSA-2026:3416, RHSA-2026:3391, RHSA-2026:1540 |
| Red Hat OpenShift 4 | skopeo +1 | 2:1.11.3-5.rhaos4.14.el8 | RHSA-2026:3416, RHSA-2026:3391, RHSA-2025:21328 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | buildah +1 | 2:1.41.6-1.el10_1 | ALSA-2025:22012 |
| AlmaLinux 10 | podman-docker | 7:5.6.0-6.el10_1 | ALSA-2025:21220 |
| AlmaLinux 9 | buildah +1 | 2:1.41.6-1.el9_7 | ALSA-2025:22011 |
| AlmaLinux 9 | podman +4 | 6:5.6.0-7.el9_7 | ALSA-2025:21702 |
| AlmaLinux 9 | runc | 4:1.2.5-3.el9_6 | ALSA-2025:20957, ALSA-2025:19927 |
| AlmaLinux 8 | aardvark-dns | 2:1.10.1-2.module_el8.10.0+3909+6e1c1eb7 | ALSA-2025:23543, ALSA-2025:21232 |
| AlmaLinux 8 | buildah | 2:1.33.12-2.module_el8.10.0+4016+efd18bf8 | ALSA-2025:23543, ALSA-2025:21232 |
| AlmaLinux 8 | buildah-tests | 2:1.33.12-2.module_el8.10.0+4047+545787c4 | ALSA-2025:23543, ALSA-2025:21232 |
| AlmaLinux 8 | cockpit-podman | 84.1-1.module_el8.10.0+4016+efd18bf8 | ALSA-2025:23543, ALSA-2025:21232 |
| AlmaLinux 8 | conmon | 3:2.1.10-1.module_el8.10.0+3970+8445edf6 | ALSA-2025:23543, ALSA-2025:21232 |
| AlmaLinux 8 | container-selinux | 2:2.229.0-2.module_el8.10.0+3909+6e1c1eb7 | ALSA-2025:23543, ALSA-2025:21232 |
| AlmaLinux 8 | containernetworking-plugins | 1:1.4.0-6.module_el8.10.0+4016+efd18bf8 | ALSA-2025:23543, ALSA-2025:21232 |
| AlmaLinux 8 | containers-common | 2:1-82.module_el8.10.0+3876+e55593a8 | ALSA-2025:23543, ALSA-2025:21232 |
| AlmaLinux 8 | crit | 3.18-5.module_el8.10.0+3845+87b84552 | ALSA-2025:23543, ALSA-2025:21232 |
| AlmaLinux 8 | criu +1 | 3.18-5.module_el8.10.0+3876+e55593a8 | ALSA-2025:23543, ALSA-2025:21232 |
| AlmaLinux 8 | criu-devel | 3.18-5.module_el8.10.0+3858+6ad51f9f | ALSA-2025:23543, ALSA-2025:21232 |
| AlmaLinux 8 | criu-libs | 3.18-5.module_el8.10.0+3909+6e1c1eb7 | ALSA-2025:23543, ALSA-2025:21232 |
| AlmaLinux 8 | crun | 1.14.3-2.module_el8.10.0+3845+87b84552 | ALSA-2025:23543, ALSA-2025:21232 |
| AlmaLinux 8 | fuse-overlayfs | 1.13-1.module_el8.10.0+3792+03eaed9c | ALSA-2025:23543, ALSA-2025:21232 |
| AlmaLinux 8 | libslirp | 4.4.0-2.module_el8.10.0+3845+87b84552 | ALSA-2025:23543, ALSA-2025:21232 |
| AlmaLinux 8 | libslirp-devel | 4.4.0-2.module_el8.10.0+3909+6e1c1eb7 | ALSA-2025:23543, ALSA-2025:21232 |
| AlmaLinux 8 | netavark | 2:1.10.3-1.module_el8.10.0+3926+f12484f5 | ALSA-2025:23543, ALSA-2025:21232 |
| AlmaLinux 8 | oci-seccomp-bpf-hook | 1.2.10-1.module_el8.10.0+3909+6e1c1eb7 | ALSA-2025:23543, ALSA-2025:21232 |
| AlmaLinux 8 | podman +6 | 4:4.9.4-23.module_el8.10.0+4047+545787c4 | ALSA-2025:23543, ALSA-2025:21232 |
| AlmaLinux 8 | python3-podman | 4.9.0-3.module_el8.10.0+4016+efd18bf8 | ALSA-2025:23543, ALSA-2025:21232 |
| AlmaLinux 8 | runc | 4:1.2.5-2.module_el8.10.0+4068+0e21408f | ALSA-2025:23543, ALSA-2025:21232 |
| AlmaLinux 8 | skopeo | 2:1.14.5-4.module_el8.10.0+4047+545787c4 | ALSA-2025:23543, ALSA-2025:21232 |
| AlmaLinux 8 | skopeo-tests | 2:1.14.5-4.module_el8.10.0+4016+efd18bf8 | ALSA-2025:23543, ALSA-2025:21232 |
| AlmaLinux 8 | slirp4netns | 1.2.3-1.module_el8.10.0+3876+e55593a8 | ALSA-2025:23543, ALSA-2025:21232 |
| AlmaLinux 8 | toolbox | 0.0.99.5-2.module_el8.10.0+3845+87b84552 | ALSA-2025:23543, ALSA-2025:21232 |
| AlmaLinux 8 | toolbox-tests | 0.0.99.5-2.module_el8.10.0+3858+6ad51f9f | ALSA-2025:23543, ALSA-2025:21232 |
| AlmaLinux 8 | udica | 0.2.6-21.module_el8.10.0+4068+0e21408f | ALSA-2025:23543, ALSA-2025:21232 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | buildah | 2:1.41.6-1.el10_1 | RLSA-2025:22012 |
| Rocky Linux 10 | podman | 7:5.6.0-6.el10_1 | RLSA-2025:21220 |
| Rocky Linux 9 | buildah | 2:1.41.6-1.el9_7 | RLSA-2025:22011 |
| Rocky Linux 9 | podman | 6:5.6.0-7.el9_7 | RLSA-2025:21702 |
| Rocky Linux 9 | runc | 4:1.3.0-4.el9_7 | RLSA-2025:20957 |
| Rocky Linux 8 | aardvark-dns | 2:1.10.1-2.module+el8.10.0+1874+ce489889 | RLSA-2025:23543, RLSA-2025:21232 |
| Rocky Linux 8 | buildah | 2:1.33.12-2.module+el8.10.0+2001+6a33db9f | RLSA-2025:21232 |
| Rocky Linux 8 | cockpit-podman | 84.1-1.module+el8.10.0+1815+5fe7415e | RLSA-2025:23543, RLSA-2025:21232 |
| Rocky Linux 8 | conmon | 3:2.1.10-1.module+el8.10.0+1815+5fe7415e | RLSA-2025:23543, RLSA-2025:21232 |
| Rocky Linux 8 | container-selinux | 2:2.229.0-2.module+el8.10.0+1815+5fe7415e | RLSA-2025:23543, RLSA-2025:21232 |
| Rocky Linux 8 | containernetworking-plugins | 1:1.4.0-6.module+el8.10.0+2001+6a33db9f | RLSA-2025:23543, RLSA-2025:21232 |
| Rocky Linux 8 | containers-common | 2:1-82.module+el8.10.0+1843+6892ab28 | RLSA-2025:23543, RLSA-2025:21232 |
| Rocky Linux 8 | criu | 3.18-5.module+el8.10.0+1815+5fe7415e | RLSA-2025:23543, RLSA-2025:21232 |
| Rocky Linux 8 | crun | 1.14.3-2.module+el8.10.0+1815+5fe7415e | RLSA-2025:23543, RLSA-2025:21232 |
| Rocky Linux 8 | fuse-overlayfs | 1.13-1.module+el8.10.0+1815+5fe7415e | RLSA-2025:23543, RLSA-2025:21232 |
| Rocky Linux 8 | libslirp | 4.4.0-2.module+el8.10.0+1815+5fe7415e | RLSA-2025:23543, RLSA-2025:21232 |
| Rocky Linux 8 | netavark | 2:1.10.3-1.module+el8.10.0+1815+5fe7415e | RLSA-2025:23543, RLSA-2025:21232 |
| Rocky Linux 8 | oci-seccomp-bpf-hook | 1.2.10-1.module+el8.10.0+1815+5fe7415e | RLSA-2025:23543, RLSA-2025:21232 |
| Rocky Linux 8 | podman | 4:4.9.4-23.module+el8.10.0+2064+309a12a4 | RLSA-2025:21232 |
| Rocky Linux 8 | python-podman | 4.9.0-3.module+el8.10.0+1896+b18fa106 | RLSA-2025:23543, RLSA-2025:21232 |
| Rocky Linux 8 | runc | 4:1.2.5-2.module+el8.10.0+2095+5cd7f3af | RLSA-2025:21232 |
| Rocky Linux 8 | skopeo | 2:1.14.5-4.module+el8.10.0+2001+6a33db9f | RLSA-2025:21232 |
| Rocky Linux 8 | slirp4netns | 1.2.3-1.module+el8.10.0+1815+5fe7415e | RLSA-2025:23543, RLSA-2025:21232 |
| Rocky Linux 8 | toolbox | 0.0.99.5-2.module+el8.10.0+1815+5fe7415e.rocky.0.2.rocky.0.2 | RLSA-2025:23543, RLSA-2025:21232 |
| Rocky Linux 8 | udica | 0.2.6-21.module+el8.10.0+1815+5fe7415e | RLSA-2025:23543, RLSA-2025:21232 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | alloy | 1.12.2-150700.15.15.1 | SUSE-SU-2026:0327-1 |
| SLES 15 SP7 | buildah | 1.35.5-150500.3.45.1 | SUSE-SU-2026:2733-1, SUSE-SU-2025:4076-1 |
| SLES 15 SP7 | podman | 4.9.5-150500.3.56.2 | SUSE-SU-2025:4081-1 |
| SLES 15 SP7 | runc | 1.2.7-150000.80.1 | SUSE-SU-2025:4073-1, SUSE-SU-2025:3950-1 |
| SLES 15 SP6 | buildah | 1.35.5-150500.3.45.1 | SUSE-SU-2026:2733-1, SUSE-SU-2025:4076-1 |
| SLES 15 SP6 | podman | 4.9.5-150500.3.56.2 | SUSE-SU-2025:4081-1 |
| SLES 15 SP6 | runc | 1.2.7-150000.80.1 | SUSE-SU-2025:4073-1, SUSE-SU-2025:3950-1 |
| SLES 15 SP5 | buildah | 1.35.5-150500.3.45.1 | SUSE-SU-2026:2733-1, SUSE-SU-2025:4076-1 |
| SLES 15 SP5 | podman | 4.9.5-150500.3.56.2 | SUSE-SU-2025:4081-1 |
| SLES 15 SP5 | runc | 1.2.7-150000.80.1 | SUSE-SU-2025:4073-2, SUSE-SU-2025:3950-1 |
| SLES 15 SP4 | buildah | 1.35.5-150400.3.53.1 | SUSE-SU-2026:2706-1, SUSE-SU-2025:4074-1 |
| SLES 15 SP4 | podman | 4.9.5-150400.4.59.2 | SUSE-SU-2025:4079-1 |
| SLES 15 SP4 | runc | 1.2.7-150000.80.1 | SUSE-SU-2025:4073-2, SUSE-SU-2025:3950-1 |
| SLES 15 SP3 | buildah | 1.35.5-150300.8.46.1 | SUSE-SU-2025:4075-1 |
| SLES 15 SP3 | podman | 4.9.5-150300.9.63.2 | SUSE-SU-2025:4080-1 |
| SLES 15 SP3 | runc | 1.2.7-150000.80.1 | SUSE-SU-2025:4073-2, SUSE-SU-2025:3950-1 |
Show 19 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 SP5 | runc | 1.2.7-16.67.1 | SUSE-SU-2025:4077-1, SUSE-SU-2025:3951-1 |
| SLES for SAP 16.0 | alloy | 1.12.2-160000.1.1 | SUSE-SU-2026:20214-1 |
| SLES for SAP 16.0 | buildah | 1.39.5-160000.1.1 | SUSE-SU-2026:20123-1 |
| SLES for SAP 16.0 | podman | 5.4.2-160000.3.1 | SUSE-SU-2026:20626-1, SUSE-SU-2026:20103-1 |
| SLES for SAP 16.0 | runc | 1.3.3-160000.1.1 | SUSE-SU-2025:21136-1 |
| SLES for SAP 15 SP6 | buildah | 1.35.5-150500.3.62.1 | SUSE-SU-2026:2733-1 |
| SLES for SAP 15 SP5 | buildah | 1.35.5-150500.3.45.1 | SUSE-SU-2026:2733-1, SUSE-SU-2025:4076-1 |
| SLES for SAP 15 SP5 | podman | 4.9.5-150500.3.56.2 | SUSE-SU-2025:4081-1 |
| SLES for SAP 15 SP5 | runc | 1.2.7-150000.80.1 | SUSE-SU-2025:4073-2, SUSE-SU-2025:3950-1 |
| SLES for SAP 15 SP4 | buildah | 1.35.5-150400.3.53.1 | SUSE-SU-2026:2706-1, SUSE-SU-2025:4074-1 |
| SLES for SAP 15 SP4 | podman | 4.9.5-150400.4.59.2 | SUSE-SU-2025:4079-1 |
| SLES for SAP 15 SP4 | runc | 1.2.7-150000.80.1 | SUSE-SU-2025:4073-2, SUSE-SU-2025:3950-1 |
| SLES for SAP 15 SP3 | buildah | 1.35.5-150300.8.46.1 | SUSE-SU-2025:4075-1 |
| SLES for SAP 15 SP3 | podman | 4.9.5-150300.9.63.2 | SUSE-SU-2025:4080-1 |
| SLES for SAP 15 SP3 | runc | 1.2.7-150000.80.1 | SUSE-SU-2025:4073-2, SUSE-SU-2025:3950-1 |
| SLES 16.0 | alloy | 1.12.2-160000.1.1 | SUSE-SU-2026:20214-1 |
| SLES 16.0 | buildah | 1.39.5-160000.1.1 | SUSE-SU-2026:20123-1 |
| SLES 16.0 | podman | 5.4.2-160000.3.1 | SUSE-SU-2026:20626-1, SUSE-SU-2026:20103-1 |
| SLES 16.0 | runc | 1.3.3-160000.1.1 | SUSE-SU-2025:21136-1 |
| SLE Micro 6.2 | podman | 5.4.2-160000.3.1 | SUSE-SU-2026:20641-1, SUSE-SU-2026:20116-1 |
| SLE Micro 6.2 | runc | 1.3.3-160000.1.1 | SUSE-SU-2025:21072-1 |
| SLE Micro 6.1 | podman | 5.4.2-slfo.1.1_5.1 | SUSE-SU-2026:24378-1, SUSE-SU-2026:22451-1 |
| SLE Micro 6.1 | runc | 1.3.3-slfo.1.1_1.1 | SUSE-SU-2025:21054-1 |
| SLE Micro 6.0 | podman | 4.9.5-9.1 | SUSE-SU-2026:22516-1, SUSE-SU-2025:21038-1 |
| SLE Micro 6.0 | runc | 1.3.3-1.1 | SUSE-SU-2025:21036-1 |
| SLE Micro 5.5 | podman | 4.9.5-150500.3.56.2 | SUSE-SU-2025:4081-1 |
| SLE Micro 5.5 | runc | 1.2.7-150000.80.1 | SUSE-SU-2025:4073-1, SUSE-SU-2025:3950-1 |
| SLE Micro 5.4 | podman | 4.9.5-150400.4.59.2 | SUSE-SU-2025:4079-1 |
| SLE Micro 5.4 | runc | 1.2.7-150000.80.1 | SUSE-SU-2025:4073-1, SUSE-SU-2025:3950-1 |
| SLE Micro 5.3 | podman | 4.9.5-150400.4.59.2 | SUSE-SU-2025:4079-1 |
| SLE Micro 5.3 | runc | 1.2.7-150000.80.1 | SUSE-SU-2025:4073-1, SUSE-SU-2025:3950-1 |
| SLE Micro 5.2 | podman | 4.9.5-150300.9.63.2 | SUSE-SU-2025:4080-1 |
| SLE Micro 5.2 | runc | 1.2.7-150000.80.1 | SUSE-SU-2025:4073-1, SUSE-SU-2025:3950-1 |
| SLE Micro 5.1 | podman | 4.9.5-150300.9.63.2 | SUSE-SU-2025:4080-1 |
| SLE HPC 15 SP5 | buildah | 1.35.5-150500.3.45.1 | SUSE-SU-2026:2733-1, SUSE-SU-2025:4076-1 |
| SLE HPC 15 SP5 | podman | 4.9.5-150500.3.56.2 | SUSE-SU-2025:4081-1 |
| SLE HPC 15 SP5 | runc | 1.2.7-150000.80.1 | SUSE-SU-2025:4073-2, SUSE-SU-2025:3950-1 |
| SLE HPC 15 SP4 | buildah | 1.35.5-150400.3.53.1 | SUSE-SU-2026:2706-1, SUSE-SU-2025:4074-1 |
| SLE HPC 15 SP4 | podman | 4.9.5-150400.4.59.2 | SUSE-SU-2025:4079-1 |
| SLE HPC 15 SP4 | runc | 1.2.7-150000.80.1 | SUSE-SU-2025:4073-2, SUSE-SU-2025:3950-1 |
| SLE HPC 15 SP3 | buildah | 1.35.5-150300.8.46.1 | SUSE-SU-2025:4075-1 |
| SLE HPC 15 SP3 | podman | 4.9.5-150300.9.63.2 | SUSE-SU-2025:4080-1 |
| SLE HPC 15 SP3 | runc | 1.2.7-150000.80.1 | SUSE-SU-2025:4073-2, SUSE-SU-2025:3950-1 |
| SUSE Enterprise Storage 7.1 | buildah | 1.35.5-150300.8.46.1 | SUSE-SU-2025:4075-1 |
| SUSE Enterprise Storage 7.1 | podman | 4.9.5-150300.9.63.2 | SUSE-SU-2025:4080-1 |
| SUSE Enterprise Storage 7.1 | runc | 1.2.7-150000.80.1 | SUSE-SU-2025:4073-1, SUSE-SU-2025:3950-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | buildah | 1.42.2-1.1 | openSUSE-SU-2025:15843-1 |
| openSUSE Tumbleweed | incus | 6.17-2.1 | openSUSE-SU-2025:15721-1 |
| openSUSE Tumbleweed | podman | 5.7.1-1.1 | openSUSE-SU-2025:15845-1 |
| openSUSE Tumbleweed | runc | 1.3.3-1.1 | openSUSE-SU-2025:15705-1 |
| openSUSE Leap 16.0 | alloy | 1.12.2-160000.1.1 | openSUSE-SU-2026:20140-1 |
| openSUSE Leap 16.0 | buildah | 1.39.5-160000.1.1 | openSUSE-SU-2026:20080-1 |
| openSUSE Leap 16.0 | govulncheck-vulndb | 0.0.20260723T184607-160000.1.1 | openSUSE-SU-2026:21483-1 |
| openSUSE Leap 16.0 | podman | 5.4.2-160000.3.1 | openSUSE-SU-2026:21244-1, openSUSE-SU-2026:20305-1, openSUSE-SU-2026:20072-1 |
| openSUSE Leap 16.0 | runc | 1.3.3-160000.1.1 | openSUSE-SU-2025:20072-1 |
| openSUSE Leap 15.6 | buildah | 1.35.5-150500.3.45.1 | SUSE-SU-2025:4076-1 |
| openSUSE Leap 15.6 | podman | 4.9.5-150500.3.56.2 | SUSE-SU-2025:4081-1 |
| openSUSE Leap 15.6 | runc | 1.2.7-150000.80.1 | SUSE-SU-2025:4073-1, SUSE-SU-2025:3950-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | buildah | 1.42.1-r0 | — |
| Alpine v3.24 | podman | 5.7.0-r0 | — |
| Alpine v3.24 | runc | 1.3.3-r0 | — |
| Alpine v3.23 | buildah | 1.42.1-r0 | — |
| Alpine v3.23 | podman | 5.7.0-r0 | — |
| Alpine v3.23 | runc | 1.3.3-r0 | — |
| Alpine v3.22 | buildah | 1.41.6-r0 | — |
| Alpine v3.22 | podman | 5.6.2-r1 | — |
| Alpine v3.22 | runc | 1.3.3-r0 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | runc | 1.3.3-2.amzn2023.0.1 | ALAS2023-2025-1286 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | kubernetes | 1.30.10-18 | — |
| Azure Linux 3 | runc | 1.3.3-1 | — |
| Azure Linux 2 (CBL-Mariner) | moby-runc | 1.2.8-1 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 10 | buildah +1 | 2:1.41.6-1.0.1.el10_1 | ELSA-2025-22012 |
| Oracle Linux 10 | podman +3 | 7:5.6.0-6.0.1.el10_1 | ELSA-2025-21220 |
| Oracle Linux 9 | buildah +1 | 2:1.41.6-1.0.1.el9_7 | ELSA-2025-22011 |
| Oracle Linux 9 | podman +4 | 6:5.6.0-7.0.1.el9_7 | ELSA-2025-21702 |
| Oracle Linux 9 | runc | 4:1.2.5-3.el9_6 | ELSA-2025-20957, ELSA-2025-19927 |
| Oracle Linux 8 | aardvark-dns | 2:1.10.1-2.module+el8.10.0+90704+e5ea1250 | ELSA-2025-23543, ELSA-2025-21232 |
| Oracle Linux 8 | buildah +1 | 2:1.33.12-2.module+el8.10.0+90704+e5ea1250 | ELSA-2025-23543, ELSA-2025-21232 |
| Oracle Linux 8 | cockpit-podman | 84.1-1.module+el8.10.0+90704+e5ea1250 | ELSA-2025-23543, ELSA-2025-21232 |
| Oracle Linux 8 | conmon | 3:2.1.10-1.module+el8.10.0+90704+e5ea1250 | ELSA-2025-23543, ELSA-2025-21232 |
| Oracle Linux 8 | container-selinux | 2:2.229.0-2.module+el8.10.0+90704+e5ea1250 | ELSA-2025-23543, ELSA-2025-21232 |
| Oracle Linux 8 | containernetworking-plugins | 1:1.4.0-6.module+el8.10.0+90704+e5ea1250 | ELSA-2025-23543, ELSA-2025-21232 |
| Oracle Linux 8 | containers-common | 2:1-82.0.1.module+el8.10.0+90704+e5ea1250 | ELSA-2025-23543, ELSA-2025-21232 |
| Oracle Linux 8 | crit +4 | 3.18-5.module+el8.10.0+90704+e5ea1250 | ELSA-2025-23543, ELSA-2025-21232 |
| Oracle Linux 8 | crun | 1.14.3-2.module+el8.10.0+90704+e5ea1250 | ELSA-2025-23543, ELSA-2025-21232 |
| Oracle Linux 8 | fuse-overlayfs | 1.13-1.module+el8.10.0+90704+e5ea1250 | ELSA-2025-23543, ELSA-2025-21232 |
| Oracle Linux 8 | libslirp +1 | 4.4.0-2.module+el8.10.0+90704+e5ea1250 | ELSA-2025-23543, ELSA-2025-21232 |
| Oracle Linux 8 | netavark | 2:1.10.3-1.module+el8.10.0+90704+e5ea1250 | ELSA-2025-23543, ELSA-2025-21232 |
| Oracle Linux 8 | oci-seccomp-bpf-hook | 1.2.10-1.module+el8.10.0+90704+e5ea1250 | ELSA-2025-23543, ELSA-2025-21232 |
| Oracle Linux 8 | podman +6 | 4:4.9.4-23.0.1.module+el8.10.0+90704+e5ea1250 | ELSA-2025-23543, ELSA-2025-21232 |
| Oracle Linux 8 | python3-podman | 4.9.0-3.module+el8.10.0+90704+e5ea1250 | ELSA-2025-23543, ELSA-2025-21232 |
| Oracle Linux 8 | runc | 4:1.2.5-2.module+el8.10.0+90704+e5ea1250 | ELSA-2025-23543, ELSA-2025-21232 |
| Oracle Linux 8 | skopeo +1 | 2:1.14.5-4.module+el8.10.0+90704+e5ea1250 | ELSA-2025-23543, ELSA-2025-21232 |
| Oracle Linux 8 | slirp4netns | 1.2.3-1.module+el8.10.0+90704+e5ea1250 | ELSA-2025-23543, ELSA-2025-21232 |
| Oracle Linux 8 | udica | 0.2.6-21.module+el8.10.0+90704+e5ea1250 | ELSA-2025-23543, ELSA-2025-21232 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | buildah | 1.42.1-r0 | — |
| Wolfi rolling | checksec | 3.0.2-r7 | — |
| Wolfi rolling | ctop | 0.7.7-r35 | — |
| Wolfi rolling | ctr-1 +4 | 1.7.29-r1 | — |
| Wolfi rolling | dagger | 0.19.6-r1 | — |
| Wolfi rolling | docker-machine-driver-harvester | 1.1.0-r1 | — |
| Wolfi rolling | envoy-gateway-egctl | 1.7.0-r0 | — |
| Wolfi rolling | falco-no-driver | 0.43.0-r0 | — |
| Wolfi rolling | grafana-alloy | 1.11.3-r1 | — |
| Wolfi rolling | grype | 0.103.0-r1 | — |
| Wolfi rolling | k3s +2 | 1.34.1.1-r2 | — |
| Wolfi rolling | k3s-1.32 +2 | 1.32.9.1-r2 | — |
| Wolfi rolling | k8s-device-plugin +3 | 0.18.0-r1 | — |
| Wolfi rolling | k9s | 0.50.16-r2 | — |
| Wolfi rolling | kots | 1.129.1-r0 | — |
| Wolfi rolling | kubeadm-1.34 +18 | 1.34.1-r3 | — |
| Wolfi rolling | kubectl-1.30 +2 | 1.30.14-r8 | — |
| Wolfi rolling | kubernetes-csi-driver-nfs +1 | 4.12.1-r2 | — |
| Wolfi rolling | kubescape | 3.0.44-r0 | — |
| Wolfi rolling | kubescape-operator | 0.2.112-r0 | — |
| Wolfi rolling | mesosphere-vsphere-csi +2 | 3.5.0-r4 | — |
| Wolfi rolling | nerdctl | 2.2.0-r1 | — |
| Wolfi rolling | neuvector-scanner +2 | 3.974-r2 | — |
| Wolfi rolling | newrelic-infrastructure-agent | 1.71.0-r1 | — |
| Wolfi rolling | node-feature-discovery-0.18 | 0.18.3-r1 | — |
| Wolfi rolling | nvidia-container-toolkit-nvidia-ctk +1 | 1.18.1-r0 | — |
| Wolfi rolling | osv-scanner | 2.2.4-r2 | — |
| Wolfi rolling | podman +1 | 5.6.2-r3 | — |
| Wolfi rolling | skaffold | 2.16.1-r4 | — |
| Wolfi rolling | skopeo | 1.23.0-r0 | — |
| Wolfi rolling | spegel +1 | 0.5.1-r1 | — |
| Wolfi rolling | sriov-network-device-plugin +1 | 3.10.0-r2 | — |
| Wolfi rolling | syft | 1.37.0-r1 | — |
| Wolfi rolling | trivy | 0.67.2-r2 | — |
| Wolfi rolling | trivy-operator | 0.29.0-r2 | — |
| Wolfi rolling | undock | 0.14.0-r0 | — |
| Wolfi rolling | wolfictl | 0.38.21-r2 | — |
| Wolfi rolling | xeol +1 | 0.10.8-r18 | — |
| Wolfi rolling | zarf | 0.65.1-r2 | — |
| Wolfi rolling | zot | 2.1.10-r1 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
GitHub 1 repository
-
jq6l43d1/proxmox-lxc-docker-fix ★ 14 · Nov 11, 2025
Workaround for CVE-2025-52881: Fixes Docker/Podman breakage in Proxmox LXC containers caused by AppArmor incompatibility with runc 1.2.7+. Universal wrapper for community-scripts with automatic AppAr…
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/opencontainers/runc | < 1.2.8 | 1.2.8 | GHSA-cgrx-mc8f-2prm |
| Go | github.com/opencontainers/runc | >= 1.3.0-rc.1, < 1.3.3 | 1.3.3 | GHSA-cgrx-mc8f-2prm |
| Go | github.com/opencontainers/runc | >= 1.4.0-rc.1, < 1.4.0-rc.3 | 1.4.0-rc.3 | GHSA-cgrx-mc8f-2prm |
| Go | github.com/opencontainers/runc | < 1.2.8 · >= 1.3.0-rc.1, < 1.3.3 · >= 1.4.0-rc.1, < 1.4.0-rc.3 | 1.2.8, 1.3.3, 1.4.0-rc.3 | GO-2025-4098 |
| Go | github.com/opencontainers/selinux | < 1.13.0 | 1.13.0 | GHSA-cgrx-mc8f-2prm |
Advisories 50
- WID-SEC-2026-3046 IBM Concert: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 10, 2026
- ALSA-2025:22012 Important: buildah security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2025:21702 Important: podman security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2025:22011 Important: buildah security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2025:19927 Important: runc security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2025:20957 Important: runc security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2025:21220 Important: podman security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2025:23543 Important: container-tools:rhel8 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2025:21232 Important: container-tools:rhel8 security update AlmaLinux Security Advisories · Oct 29, 2026
- SUSE-SU-2026:24378-1 Security update for podman SUSE / openSUSE Security Updates · Oct 27, 2026
- WID-SEC-2025-2518 Red Hat Enterprise Linux (runc): Mehrere Schwachstellen ermöglichen Umgehen von Sicherheitsvorkehrungen BSI CERT-Bund (WID) · Oct 26, 2026
- RHSA-2026:8325 Red Hat Security Advisory: buildah, crun, podman, runc, and skopeo security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:4693 Red Hat Security Advisory: container-tools:rhel8 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:4532 Red Hat Security Advisory: buildah security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:4533 Red Hat Security Advisory: podman security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:3416 Red Hat Security Advisory: OpenShift Container Platform 4.17.50 packages and security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:3391 Red Hat Security Advisory: OpenShift Container Platform 4.19.25 packages and security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:10703 Red Hat Security Advisory: container-tools:rhel8 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:0426 Red Hat Security Advisory: buildah security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:0424 Red Hat Security Advisory: podman security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2025:23347 Red Hat Security Advisory: podman security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2025:22030 Red Hat Security Advisory: podman security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2025:22012 Red Hat Security Advisory: buildah security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2025:22011 Red Hat Security Advisory: buildah security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2025:21328 Red Hat Security Advisory: OpenShift Container Platform 4.14.59 packages and security update Red Hat Security Advisories (RHSA) · Oct 17, 2026
- RHSA-2026:4531 Red Hat Security Advisory: runc security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:2975 Red Hat Security Advisory: OpenShift Container Platform 4.18.34 packages and security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:1540 Red Hat Security Advisory: OpenShift Container Platform 4.15.61 packages and security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:0995 Red Hat Security Advisory: OpenShift Container Platform 4.14.61 packages and security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:0701 Red Hat Security Advisory: OpenShift Container Platform 4.17.47 packages and security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:0676 Red Hat Security Advisory: OpenShift Container Platform 4.13.63 packages and security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:0425 Red Hat Security Advisory: runc security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:0418 Red Hat Security Advisory: OpenShift Container Platform 4.16.55 packages and security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:0331 Red Hat Security Advisory: OpenShift Container Platform 4.18.31 packages and security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:0315 Red Hat Security Advisory: OpenShift Container Platform 4.12.84 packages and security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2025:23543 Red Hat Security Advisory: container-tools:rhel8 security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2025:21702 Red Hat Security Advisory: podman security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2025:21634 Red Hat Security Advisory: buildah security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2025:21633 Red Hat Security Advisory: buildah security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2025:21232 Red Hat Security Advisory: container-tools:rhel8 security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2025:21220 Red Hat Security Advisory: podman security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2025:20957 Red Hat Security Advisory: runc security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2025:19927 Red Hat Security Advisory: runc security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- WID-SEC-2026-2253 IBM Security Verify Access: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 17, 2026
- openSUSE-SU-2026:21483-1 Security update for govulncheck-vulndb SUSE / openSUSE Security Updates · Jul 31, 2026
- SUSE-SU-2026:22516-1 Security update for podman SUSE / openSUSE Security Updates · Jul 9, 2026
- openSUSE-SU-2026:21244-1 Security update for podman SUSE / openSUSE Security Updates · Jul 9, 2026
- SUSE-SU-2026:22451-1 Security update for podman SUSE / openSUSE Security Updates · Jul 4, 2026
- SUSE-SU-2026:2733-1 Security update for buildah SUSE / openSUSE Security Updates · Jul 4, 2026
- SUSE-SU-2026:2706-1 Security update for buildah SUSE / openSUSE Security Updates · Jul 1, 2026
References
- https://github.com/opencontainers/runc/security/advisories/GHSA-cgrx-mc8f-2prm
- https://github.com/opencontainers/runc/security/advisories/GHSA-qw9x-cqr3-wc7r
- https://github.com/opencontainers/runc/security/advisories/GHSA-9493-h29p-rfm2
- https://github.com/opencontainers/runc/commit/ff94f9991bd32076c871ef0ad8bc1b763458e480
- https://github.com/opencontainers/runc/commit/ff6fe1324663538167eca8b3d3eec61e1bd4fa51
- https://github.com/opencontainers/runc/commit/ed6b1693b8b3ae7eb0250a7e76fc888cdacf98c1
- https://github.com/opencontainers/runc/commit/db19bbed5348847da433faa9d69e9f90192bfa64
- https://github.com/opencontainers/runc/commit/d61fd29d854b416feaaf128bf650325cd2182165
- https://github.com/opencontainers/runc/commit/d40b3439a9614a86e87b81a94c6811ec6fa2d7d2
- https://github.com/opencontainers/runc/commit/b3dd1bc562ed9996d1a0f249e056c16624046d28
- https://github.com/opencontainers/runc/commit/77d217c7c3775d8ca5af89e477e81568ef4572db
- https://github.com/opencontainers/runc/commit/77889b56db939c323d29d1130f28f9aea2edb544
- https://github.com/opencontainers/runc/commit/6fc191449109ea14bb7d61238f24a33fe08c651f
- https://github.com/opencontainers/runc/commit/4b37cd93f86e72feac866442988b549b5b7bf3e6
- https://github.com/opencontainers/runc/commit/44a0fcf685db051c80b8c269812bb177f5802c58
- https://github.com/opencontainers/runc/commit/435cc81be6b79cdec73b4002c0dae549b2f6ae6d
- https://github.com/opencontainers/runc/commit/3f925525b44d247e390e529e772a0dc0c0bc3557
- https://github.com/opencontainers/runc/blob/v1.4.0-rc.2/RELEASES.md
- http://github.com/opencontainers/runc/commit/a41366e74080fa9f26a2cd3544e2801449697322
- http://github.com/opencontainers/runc/commit/fdcc9d3cad2f85954a241ccb910a61aaa1ef47f3