Skip to content
OpenAdvisories
Low · 3.3 CVE-2026-41579 EUVD-2026-40859GHSA-xjvp-4fhw-gc47GO-2026-5761

runc: Malicious image with /dev symlink can trigger limited host filesystem integrity violations

Published Jul 1, 2026 · Updated Jul 1, 2026 · Assigned by GitHub_M

Vendor: opencontainers Product: runc Package: buildah Package: cadvisor Package: cadvisor-compat Package: docker-machine-driver-harvester Package: falco-no-driver Package: github.com/opencontainers/runc Package: k3s-1.32 Package: k3s-static-1.32 Package: mps-control-daemon Package: node-feature-discovery-0.18 Package: nvidia-container-toolkit-nvidia-cdi-hook Package: nvidia-container-toolkit-nvidia-container-runtime Package: nvidia-container-toolkit-nvidia-container-runtime-cdi Package: nvidia-container-toolkit-nvidia-container-runtime-hook Package: nvidia-container-toolkit-nvidia-container-runtime-legacy Package: nvidia-container-toolkit-nvidia-ctk Package: nvidia-container-toolkit-nvidia-ctk-installer Package: nvidia-device-plugin Package: podman Package: runc Package: runc Package: runc Package: runc Package: runc-app Package: runc-stable Package: sriov-network-device-plugin Ecosystem: Alpine Ecosystem: Azure Linux Ecosystem: Debian Ecosystem: Go Ecosystem: Ubuntu Ecosystem: Wolfi

Description

runc is a CLI tool for spawning and running containers according to the OCI specification. In versions prior to 1.3.6, 1.4.0-rc.1, 1.4.0-rc.12, 1.5.0-rc.1, and 1.5.0-rc.1, when setting up the container rootfs, setupPtmx and setupDevSymlinks call os.Remove and os.Symlink with a filepath.Join string which allow an image with /dev as a symlink to trick runc into deleting files called ptmx on the host or creating a hardcoded set of symlinks with specific names and targets in an arbitrary pre-existing host directory. This issue is not exploitable under Docker, because Docker creates a top-level read-only layer that masks any malicious /dev symlink present in the container image — unlike some other Linux container tooling, whose higher-level runtimes built on runc remain exposed to exploitation via a malicious image. This issue has been fixed in versions 1.3.6, 1.4.3 and 1.5.0.

Affected products

VendorProductAffectedFixed
opencontainers runc < 1.3.6, >= 1.4.0-rc.1, < 1.4.3, >= 1.5.0-rc.1, < 1.5.0-rc.3 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 runc 1.3.6+ds1-1 —
Debian 13 runc No fix yet —
Debian 12 runc No fix yet —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.10 runc +2 No fix yet —
Ubuntu 26.04 LTS runc +2 No fix yet —
Ubuntu 25.10 runc +2 No fix yet —
Ubuntu 24.04 LTS runc +1 No fix yet —
Ubuntu 22.04 LTS runc +1 No fix yet —
Show 3 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu 20.04 LTS runc +1 No fix yet —
Ubuntu Pro 18.04 LTS runc No fix yet —
Ubuntu Pro 16.04 LTS runc No fix yet —

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP7 runc 1.3.6-150000.101.1 SUSE-SU-2026:3433-1
SLES 15 SP6 runc 1.3.6-150000.101.1 SUSE-SU-2026:3433-2
SLES 15 SP5 runc 1.3.6-150000.101.1 SUSE-SU-2026:3433-2
SLES 15 SP4 runc 1.3.6-150000.101.1 SUSE-SU-2026:3433-2
SLES 12 SP5 runc 1.3.6-16.76.1 SUSE-SU-2026:3428-2, SUSE-SU-2026:3428-1
Show 14 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 16.0 runc 1.3.6-160000.1.1 SUSE-SU-2026:22942-1
SLES for SAP 15 SP6 runc 1.3.6-150000.101.1 SUSE-SU-2026:3433-2
SLES for SAP 15 SP5 runc 1.3.6-150000.101.1 SUSE-SU-2026:3433-2
SLES for SAP 15 SP4 runc 1.3.6-150000.101.1 SUSE-SU-2026:3433-2
SLES 16.0 runc 1.3.6-160000.1.1 SUSE-SU-2026:22942-1
SLE Micro 6.2 runc 1.3.6-160000.1.1 SUSE-SU-2026:22938-1
SLE Micro 6.1 runc 1.3.6-slfo.1.1_1.1 SUSE-SU-2026:23164-1
SLE Micro 6.0 runc 1.3.6-1.1 SUSE-SU-2026:23047-1
SLE Micro 5.5 runc 1.3.6-150000.101.1 SUSE-SU-2026:3433-1
SLE Micro 5.4 runc 1.3.6-150000.101.1 SUSE-SU-2026:3433-1
SLE Micro 5.3 runc 1.3.6-150000.101.1 SUSE-SU-2026:3433-1
SLE HPC 15 SP5 runc 1.3.6-150000.101.1 SUSE-SU-2026:3433-2
SLE HPC 15 SP4 runc 1.3.6-150000.101.1 SUSE-SU-2026:3433-2
SUSE Enterprise Storage 7.1 runc 1.3.6-150000.101.1 SUSE-SU-2026:3433-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed runc 1.4.3-1.1 openSUSE-SU-2026:11301-1
openSUSE Leap 16.0 govulncheck-vulndb 0.0.20260723T184607-160000.1.1 openSUSE-SU-2026:21483-1
openSUSE Leap 16.0 runc 1.3.6-160000.1.1 openSUSE-SU-2026:21431-1

Alpine

Security tracker ↗
ReleasePackageFixed inAdvisory
Alpine v3.24 runc 1.4.3-r0 —
Alpine v3.23 runc 1.4.3-r0 —

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 runc 1.3.6-1.amzn2023.0.1 ALAS2023-2026-2138

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 runc 1.3.6-1 —

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling buildah 1.44.0-r6 —
Wolfi rolling cadvisor 0.60.2-r1 —
Wolfi rolling cadvisor-compat 0.60.5-r8 —
Wolfi rolling docker-machine-driver-harvester 1.1.0-r1 —
Wolfi rolling falco-no-driver 0.45.0-r0 —
Wolfi rolling k3s-1.32 +1 No fix yet —
Wolfi rolling mps-control-daemon 0.20.0-r4 —
Wolfi rolling node-feature-discovery-0.18 0.18.3-r19 —
Wolfi rolling nvidia-container-toolkit-nvidia-ctk +6 1.19.1-r4 —
Wolfi rolling nvidia-device-plugin 0.19.3-r1 —
Wolfi rolling podman 6.0.0-r0 —
Wolfi rolling sriov-network-device-plugin 3.11.0-r16 —

Affected packages

EcosystemPackageAffectedFixedRecord
Go github.com/opencontainers/runc < 1.3.6 1.3.6 GHSA-xjvp-4fhw-gc47
Go github.com/opencontainers/runc >= 1.4.0, < 1.4.3 1.4.3 GHSA-xjvp-4fhw-gc47
Go github.com/opencontainers/runc >= 1.5.0-rc.1, < 1.5.0-rc.3 1.5.0-rc.3 GHSA-xjvp-4fhw-gc47
Go github.com/opencontainers/runc < 1.3.6 · >= 1.4.0, < 1.4.3 · >= 1.5.0-rc.1, < 1.5.0-rc.3 1.3.6, 1.4.3, 1.5.0-rc.3 GO-2026-5761

Advisories 12

References