{"id":"CVE-2026-123876","aliases":["ALPINE-CVE-2026-123876","AZL-113092","AZL-113095","AZL-113101","AZL-113188","AZL-113191","AZL-113194","DEBIAN-CVE-2026-123876","EUVD-2026-118387","GHSA-2fgp-24rx-f2r7","UBUNTU-CVE-2026-123876"],"status":"published","title":"Podman: containers-common: containers-common: default seccomp af_vsock/netlink_audit deny rules bypassable via 32-bit truncation","description":"A flaw was found in the default seccomp profile used by Podman via containers-common. Deny rules for AF_VSOCK and NETLINK_AUDIT compared socket arguments with unmasked 64-bit equality. Because the kernel truncates those int arguments to 32 bits, setting upper bits can bypass the deny rules.","severity":{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00151,"percentile":0.04303,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-184"],"published":"2026-11-06T17:38:41Z","modified":"2026-11-11T14:17:32Z","fixes":[{"ecosystem":"Alpine:v3.24","package":"podman","fixed_in":["5.8.10-r0"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.24","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.8.10-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.43.1-3"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"cri-o","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.30.1-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"5.6.1-10"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"kubevirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.8.4-4"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"kubevirt-openvmm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.9.0-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"libcontainers-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"20240213-3"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"golang-github-containers-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.50.1+ds1-4","0.51.0+ds1-1","0.52.0+ds1-1","0.52.0+ds1-2","0.55.4+ds1-1","0.55.4+ds1-2","0.55.4+ds1-3","0.56.0+ds1-1","0.56.0+ds1-2","0.56.0+ds1-3","0.56.0+ds1-4","0.57.0+ds1-1","0.57.0+ds1-2","0.57.2+ds1-1","0.57.2+ds1-2","0.57.4+ds1-1","0.57.4+ds1-2","0.57.4+ds1-3","0.57.4+ds1-4","0.58.0+ds1-1","0.58.2+ds1-2","0.58.2+ds1-3","0.60.0+ds1-1","0.60.1+ds1-1","0.60.1+ds1-3","0.60.2+ds1-1","0.60.2+ds1-2","0.60.3+ds1-3","0.60.4+ds1-1","0.61.0+ds1-1","0.61.0+ds1-2","0.61.1+ds1-1","0.62.0+ds1-1","0.62.2+ds1-1","0.62.2+ds1-2","0.64.1+ds1-1","0.64.1+ds1-2","0.64.1+ds1-3","0.64.2+ds1-1","0.66.0+ds2-1","0.66.0+ds2-2","0.66.0+ds2-3","0.67.0-1","0.67.0-2","0.67.1-1","0.67.1-2","0.67.1-3","0.69.1-1"]},{"source":"osv","ecosystem":"Debian:13","package":"golang-github-containers-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.62.2+ds1-2","0.64.1+ds1-1","0.64.1+ds1-2","0.64.1+ds1-3","0.64.2+ds1-1","0.66.0+ds2-1","0.66.0+ds2-2","0.66.0+ds2-3","0.67.0-1","0.67.0-2","0.67.1-1","0.67.1-2","0.67.1-3","0.69.1-1"]},{"source":"osv","ecosystem":"Debian:14","package":"golang-github-containers-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.62.2+ds1-2","0.64.1+ds1-1","0.64.1+ds1-2","0.64.1+ds1-3","0.64.2+ds1-1","0.66.0+ds2-1","0.66.0+ds2-2","0.66.0+ds2-3","0.67.0-1","0.67.0-2","0.67.1-1","0.67.1-2","0.67.1-3","0.69.1-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"golang-github-containers-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.38.16+ds1-1ubuntu1","0.44.3+ds1-2ubuntu1","0.44.4+ds1-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"skopeo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.2+dfsg1-1","1.4.1+ds1-1","1.4.1+ds1-1ubuntu0.1","1.4.1+ds1-1ubuntu0.1+esm1","1.4.1+ds1-1ubuntu0.1+esm2","1.4.1+ds1-1ubuntu0.1+esm3"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"golang-github-containers-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.50.1+ds1-4","0.56.0+ds1-4","0.57.0+ds1-2","0.57.2+ds1-2","0.57.4+ds1-2","0.57.4+ds1-2ubuntu0.1","0.57.4+ds1-2ubuntu0.2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"skopeo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.9.3+ds1-1build1","1.13.3+ds1-2","1.13.3+ds1-2build1","1.13.3+ds1-2build2","1.13.3+ds1-2ubuntu0.24.04.1","1.13.3+ds1-2ubuntu0.24.04.2","1.13.3+ds1-2ubuntu0.24.04.2+esm1","1.13.3+ds1-2ubuntu0.24.04.2+esm2","1.13.3+ds1-2ubuntu0.24.04.3","1.13.3+ds1-2ubuntu0.24.04.3+esm1","1.13.3+ds1-2ubuntu0.24.04.3+esm2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"golang-github-containers-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.66.0+ds2-3","0.67.1-2","0.67.1-3"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.7.0+ds2-3build1","5.8.3+ds1-1","5.8.4+ds1-1","5.8.6+ds1-2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"skopeo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.21.0~pre1-2build1","1.22.0+ds1-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"golang-github-containers-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.62.2+ds1-2","0.66.0+ds2-3"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.2+ds1-2","5.7.0+ds2-3","5.7.0+ds2-3build1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"skopeo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.18.0+ds1-1","1.20.0+ds1-2","1.21.0~pre1-2","1.21.0~pre1-2build1"]}],"products":[{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"red hat","product":"red hat hardened images"},{"vendor":"red hat","product":"red hat openshift container platform 4"},{"vendor":"red hat","product":"red hat openshift container platform 5"}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-123876","tags":["vdb-entry","x_refsource_REDHAT","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2566536","tags":["issue-tracking","x_refsource_REDHAT","report"]},{"url":"https://github.com/podman-container-tools/container-libs/issues/1248","tags":["exploit","report"]},{"url":"https://github.com/podman-container-tools/container-libs/pull/1249","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2026/10/27/3","tags":["report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123876","tags":["web"]},{"url":"https://github.com/advisories/GHSA-2fgp-24rx-f2r7"},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-123876","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-123876","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-123876","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-123876","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-123876","title":"Podman: containers-common: containers-common: default seccomp af_vsock/netlink_audit deny rules bypassable via 32-bit truncation","description":"A flaw was found in the default seccomp profile used by Podman via containers-common. Deny rules for AF_VSOCK and NETLINK_AUDIT compared socket arguments with unmasked 64-bit equality. Because the kernel truncates those int arguments to 32 bits, setting upper bits can bypass the deny rules.","status":"published","published":"2026-11-06T17:38:41.186Z","modified":"2026-11-10T19:57:56.86Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-184"],"updated_at":"2026-11-10T22:18:26.838446Z"}],"euvd":[{"id":"EUVD-2026-118387","description":"A flaw was found in the default seccomp profile used by Podman via containers-common. Deny rules for AF_VSOCK and NETLINK_AUDIT compared socket arguments with unmasked 64-bit equality. Because the kernel truncates those int arguments to 32 bits, setting upper bits can bypass the deny rules.","status":"published","published":"2026-11-06T17:38:41Z","modified":"2026-11-10T19:57:56Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-06T21:07:02.763568Z"}],"ghsa":[{"id":"GHSA-2fgp-24rx-f2r7","title":"A flaw was found in the default seccomp profile used by Podman via containers-common. Deny rules...","description":"A flaw was found in the default seccomp profile used by Podman via containers-common. Deny rules for AF_VSOCK and NETLINK_AUDIT compared socket arguments with unmasked 64-bit equality. Because the kernel truncates those int arguments to 32 bits, setting upper bits can bypass the deny rules.","status":"published","published":"2026-11-06T18:35:25Z","modified":"2026-11-06T18:35:33Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-184"],"updated_at":"2026-11-06T19:01:27.658277Z"}],"nvd":[{"id":"CVE-2026-123876","description":"A flaw was found in the default seccomp profile used by Podman via containers-common. Deny rules for AF_VSOCK and NETLINK_AUDIT compared socket arguments with unmasked 64-bit equality. Because the kernel truncates those int arguments to 32 bits, setting upper bits can bypass the deny rules.","status":"published","published":"2026-11-06T18:18:05.41Z","modified":"2026-11-10T20:19:03.85Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-184"],"updated_at":"2026-11-10T22:21:31.83577Z"}],"osv":[{"id":"ALPINE-CVE-2026-123876","description":"A flaw was found in the default seccomp profile used by Podman via containers-common. Deny rules for AF_VSOCK and NETLINK_AUDIT compared socket arguments with unmasked 64-bit equality. Because the kernel truncates those int arguments to 32 bits, setting upper bits can bypass the deny rules.","status":"published","published":"2026-11-06T18:18:05.41Z","modified":"2026-11-10T23:30:03.072368714Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-10T23:45:25.636162Z"},{"id":"DEBIAN-CVE-2026-123876","description":"A flaw was found in the default seccomp profile used by Podman via containers-common. Deny rules for AF_VSOCK and NETLINK_AUDIT compared socket arguments with unmasked 64-bit equality. Because the kernel truncates those int arguments to 32 bits, setting upper bits can bypass the deny rules.","status":"published","published":"2026-11-06T18:18:05.41Z","modified":"2026-11-11T09:47:47.49657216Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-08T19:09:06.023033Z"},{"id":"UBUNTU-CVE-2026-123876","description":"A flaw was found in the default seccomp profile used by Podman via containers-common. Deny rules for AF_VSOCK and NETLINK_AUDIT compared socket arguments with unmasked 64-bit equality. Because the kernel truncates those int arguments to 32 bits, setting upper bits can bypass the deny rules.","status":"published","published":"2026-11-09T00:00:00Z","modified":"2026-11-11T09:39:20.815775426Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-11T10:01:18.620522Z"},{"id":"AZL-113092","title":"CVE-2026-123876 affecting package buildah 1.43.1-3","description":"A flaw was found in the default seccomp profile used by Podman via containers-common. Deny rules for AF_VSOCK and NETLINK_AUDIT compared socket arguments with unmasked 64-bit equality. Because the kernel truncates those int arguments to 32 bits, setting upper bits can bypass the deny rules.","status":"published","published":"2026-11-06T18:18:05Z","modified":"2026-11-11T14:17:31.635127997Z","updated_at":"2026-11-11T14:42:54.020399Z"},{"id":"AZL-113095","title":"CVE-2026-123876 affecting package cri-o 1.30.1-1","description":"A flaw was found in the default seccomp profile used by Podman via containers-common. Deny rules for AF_VSOCK and NETLINK_AUDIT compared socket arguments with unmasked 64-bit equality. Because the kernel truncates those int arguments to 32 bits, setting upper bits can bypass the deny rules.","status":"published","published":"2026-11-06T18:18:05Z","modified":"2026-11-11T14:17:31.628516779Z","updated_at":"2026-11-11T14:42:54.020399Z"},{"id":"AZL-113101","title":"CVE-2026-123876 affecting package podman 5.6.1-10","description":"A flaw was found in the default seccomp profile used by Podman via containers-common. Deny rules for AF_VSOCK and NETLINK_AUDIT compared socket arguments with unmasked 64-bit equality. Because the kernel truncates those int arguments to 32 bits, setting upper bits can bypass the deny rules.","status":"published","published":"2026-11-06T18:18:05Z","modified":"2026-11-11T14:17:32.135235931Z","updated_at":"2026-11-11T14:42:54.020399Z"},{"id":"AZL-113188","title":"CVE-2026-123876 affecting package kubevirt 1.8.4-4","description":"A flaw was found in the default seccomp profile used by Podman via containers-common. Deny rules for AF_VSOCK and NETLINK_AUDIT compared socket arguments with unmasked 64-bit equality. Because the kernel truncates those int arguments to 32 bits, setting upper bits can bypass the deny rules.","status":"published","published":"2026-11-06T18:18:05Z","modified":"2026-11-11T14:17:32.799337431Z","updated_at":"2026-11-11T14:42:54.020399Z"},{"id":"AZL-113191","title":"CVE-2026-123876 affecting package kubevirt-openvmm 1.9.0-1","description":"A flaw was found in the default seccomp profile used by Podman via containers-common. Deny rules for AF_VSOCK and NETLINK_AUDIT compared socket arguments with unmasked 64-bit equality. Because the kernel truncates those int arguments to 32 bits, setting upper bits can bypass the deny rules.","status":"published","published":"2026-11-06T18:18:05Z","modified":"2026-11-11T14:17:32.682928288Z","updated_at":"2026-11-11T14:42:54.020399Z"},{"id":"AZL-113194","title":"CVE-2026-123876 affecting package libcontainers-common 20240213-3","description":"A flaw was found in the default seccomp profile used by Podman via containers-common. Deny rules for AF_VSOCK and NETLINK_AUDIT compared socket arguments with unmasked 64-bit equality. Because the kernel truncates those int arguments to 32 bits, setting upper bits can bypass the deny rules.","status":"published","published":"2026-11-06T18:18:05Z","modified":"2026-11-11T14:17:32.326946966Z","updated_at":"2026-11-11T14:42:54.020399Z"}]}}