Every CVE Search/ Get API key

CVE-2026-88265

Crun: crun: /dev/null symlink follow during stdio reopen allows host bind-mount write and chown

5.6 MediumFix available

A flaw was found in crun. After pivot_root, reopening /dev/null for stdio can follow a symlink and attach a host file to container stdio, then change that file's ownership. Affected versions are crun 1.29.1 and earlier. Default configurations that mount a fresh /dev are not exposed. No fixed release is available yet.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
High
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
High
Availability
None

Exploit likelihood

0.12%Unchanged since Sep 10, 2026
90%50%10%1%

What each source reports

CVE List Score used 5.6

Crun: crun: /dev/null symlink follow during stdio reopen allows host bind-mount write and chown

A flaw was found in crun. After pivot_root, reopening /dev/null for stdio can follow a symlink and attach a host file to container stdio, then change that file's ownership. Affected versions are crun 1.29.1 and earlier. Default configurations that mount a fresh /dev are not exposed. No fixed release is available yet.

Record
CVE-2026-88265
CVSS 3.1
5.6 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:N
Weakness
CWE-59
Updated
2026-11-02
EUVDEUVD-2026-75360 5.6

A flaw was found in crun. After pivot_root, reopening /dev/null for stdio can follow a symlink and attach a host file to container stdio, then change that file's ownership. Affected versions are crun 1.29.1 and earlier. Default configurations that mount a fresh /dev are not exposed. No fixed release is available yet.

Record
EUVD-2026-75360
CVSS 3.1
5.6 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-cwhr-hwj2-cjrp 5.6

A flaw was found in crun. After pivot_root, reopening /dev/null for stdio can follow a symlink...

A flaw was found in crun. After pivot_root, reopening /dev/null for stdio can follow a symlink and attach a host file to container stdio, then change that file's ownership. Affected versions are crun 1.29.1 and earlier. Default configurations that mount a fresh /dev are not exposed. No fixed release is available yet.

Record
GHSA-cwhr-hwj2-cjrp
CVSS 3.1
5.6 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:N
Weakness
CWE-59
Updated
2026-11-02
NVD 5.6

A flaw was found in crun. After pivot_root, reopening /dev/null for stdio can follow a symlink and attach a host file to container stdio, then change that file's ownership. Affected versions are crun 1.29.1 and earlier. Default configurations that mount a fresh /dev are not exposed. No fixed release is available yet.

Record
CVE-2026-88265
CVSS 3.1
5.6 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:N
Weakness
CWE-59
Updated
2026-11-02
OSVALPINE-CVE-2026-88265 5.6

A flaw was found in crun. After pivot_root, reopening /dev/null for stdio can follow a symlink and attach a host file to container stdio, then change that file's ownership. Affected versions are crun 1.29.1 and earlier. Default configurations that mount a fresh /dev are not exposed. No fixed release is available yet.

Record
ALPINE-CVE-2026-88265
CVSS 3.1
5.6 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:N
Updated
2026-11-03
OSVBELL-CVE-2026-88265 5.6
Record
BELL-CVE-2026-88265
CVSS 3.1
5.6 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:N
Updated
2026-11-02
Show 6 moreShow less
OSV 5.6

Crun: crun: /dev/null symlink follow during stdio reopen allows host bind-mount write and chown

A flaw was found in crun. After pivot_root, reopening /dev/null for stdio can follow a symlink and attach a host file to container stdio, then change that file's ownership. Affected versions are crun 1.29.1 and earlier. Default configurations that mount a fresh /dev are not exposed. No fixed release is available yet.

Record
CVE-2026-88265
CVSS 3.1
5.6 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:N
Weakness
CWE-59
Updated
2026-11-02
OSVDEBIAN-CVE-2026-88265 5.6

A flaw was found in crun. After pivot_root, reopening /dev/null for stdio can follow a symlink and attach a host file to container stdio, then change that file's ownership. Affected versions are crun 1.29.1 and earlier. Default configurations that mount a fresh /dev are not exposed. No fixed release is available yet.

Record
DEBIAN-CVE-2026-88265
CVSS 3.1
5.6 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:71668 5.6

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record
RHSA-2026:71668
CVSS 3.1
5.6 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2026-88265 5.6

A flaw was found in crun. After pivot_root, reopening /dev/null for stdio can follow a symlink and attach a host file to container stdio, then change that file's ownership. Affected versions are crun 1.29.1 and earlier. Default configurations that mount a fresh /dev are not exposed. No fixed release is available yet.

Record
UBUNTU-CVE-2026-88265
CVSS 3.1
5.6 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:N
Updated
2026-11-02
OSVAZL-101102 No score

CVE-2026-88265 affecting package crun 1.24-6

A flaw was found in crun. After pivot_root, reopening /dev/null for stdio can follow a symlink and attach a host file to container stdio, then change that file's ownership. Affected versions are crun 1.29.1 and earlier. Default configurations that mount a fresh /dev are not exposed. No fixed release is available yet.

Record
AZL-101102
Updated
2026-11-02
OSVopenSUSE-SU-2026:12162-1 No score

crun-1.30.1-1.1 on GA media

These are all security issues fixed in the crun-1.30.1-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:12162-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
crun
Alpine:v3.24
 before 1.30.1-r0
1.30.1-r0
crun
Azure Linux:3
 through 1.24-6 None known
crun
Alpaquita:23
 1.7-r0 up to 1.17-r2
1.17-r2
crun
Alpaquita:25
 1.21-r0 up to 1.23.1-r2
1.23.1-r2
crun
Alpaquita:stream
 1.8.5-r0 up to 1.30.1-r0
1.30.1-r0
crun
Debian:12
 All versions, plus listed versions
1.10-11.11-11.11.1-11.12-11.13-1
Show 26 moreShow less
1.14-11.14.1-11.14.4-11.15-11.16-11.16.1-11.17-11.18-11.18.1-11.18.2-11.19.1-11.20-11.21-11.21-21.21-31.24-11.26-11.27-11.27.1-11.28-11.8.1-11.8.1-1+deb12u11.8.5-11.8.6-11.8.7-11.9-1
 None known
crun
Debian:13
 All versions, plus listed versions
1.21-11.21-21.21-31.24-11.26-11.27-11.27.1-11.28-1
 None known
crun
Debian:14
 All versions, plus listed versions
1.21-11.21-21.21-31.24-11.26-11.27-11.27.1-11.28-1
 None known
crun
Red Hat:hummingbird:1
 before 0:1.30-1.hum1
0:1.30-1.hum1
crun-krun
Red Hat:hummingbird:1
 before 0:1.30-1.hum1
0:1.30-1.hum1
Show 7 moreShow less
Affected packages
PackageAffectedFixed
crun-wasm
Red Hat:hummingbird:1
 before 0:1.30-1.hum1
0:1.30-1.hum1
crun
Ubuntu:20.04:LTS
 All versions, plus listed versions
0.10.5+dfsg-10.10.6+dfsg-10.11+dfsg-10.12+dfsg-10.12.1+dfsg-1
 None known
crun
Ubuntu:22.04:LTS
 All versions, plus listed versions
0.17+dfsg-10.17+dfsg-1.10.17+dfsg-1.1ubuntu0.1
 None known
crun
Ubuntu:24.04:LTS
 All versions, plus listed versions
1.8.5-11.11-11.11.1-11.12-11.13-11.14-11.14.1-1
 None known
crun
Ubuntu:26.10
 All versions, plus listed versions
1.21-1ubuntu3
 None known
crun
Ubuntu:26.04:LTS
 All versions, plus listed versions
1.21-1ubuntu21.21-1ubuntu3
 None known
crun
openSUSE:Tumbleweed
 before 1.30.1-1.1
1.30.1-1.1

History

History
RecordedChangedSources
affected, aliases, referencesOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-88265 is a medium vulnerability (CVSS 5.6) in Red Hat Enterprise Linux 10, published September 10, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.12%, the 1st percentile. Fixed in crun 1.30.1-r0.

References

Show 18 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open