Vulnerability · Published Jul 1, 2026 · Assigned by GitHub_M
CVE-2026-41579runc: Malicious image with /dev symlink can trigger limited host filesystem integrity violations
Low 3.3
In plain English
A low-severity security flaw in runc from opencontainers. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 8% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
runc is a CLI tool for spawning and running containers according to the OCI specification. In versions prior to 1.3.6, 1.4.0-rc.1, 1.4.0-rc.12, 1.5.0-rc.1, and 1.5.0-rc.1, when setting up the container rootfs, setupPtmx and setupDevSymlinks call os.Remove and os.Symlink with a filepath.Join string which allow an image with /dev as a symlink to trick runc into deleting files called ptmx on the host or creating a hardcoded set of symlinks with specific names and targets in an arbitrary pre-existing host directory. This issue is not exploitable under Docker, because Docker creates a top-level read-only layer that masks any malicious /dev symlink present in the container image — unlike some other Linux container tooling, whose higher-level runtimes built on runc remain exposed to exploitation via a malicious image. This issue has been fixed in versions 1.3.6, 1.4.3 and 1.5.0.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.24 | runc | 1.4.3-r0 | ALPINE-CVE-2026-41579 |
| Debian:12 | runc | no fix listed | DEBIAN-CVE-2026-41579 |
| Debian:13 | runc | no fix listed | DEBIAN-CVE-2026-41579 |
| Debian:14 | runc | 1.3.6+ds1-1 | DEBIAN-CVE-2026-41579 |
| Go | github.com/opencontainers/runc | 1.3.6, 1.4.3, 1.5.0-rc.3 | GO-2026-5761 |
| Go | github.com/opencontainers/runc | 1.3.6 | GHSA-xjvp-4fhw-gc47 |
| Go | github.com/opencontainers/runc | 1.4.3 | GHSA-xjvp-4fhw-gc47 |
| Go | github.com/opencontainers/runc | 1.5.0-rc.3 | GHSA-xjvp-4fhw-gc47 |
| Ubuntu:22.04:LTS | runc | no fix listed | UBUNTU-CVE-2026-41579 |
| Ubuntu:24.04:LTS | runc | no fix listed | UBUNTU-CVE-2026-41579 |
| Ubuntu:25.10 | runc | no fix listed | UBUNTU-CVE-2026-41579 |
| Ubuntu:26.04:LTS | runc | no fix listed | UBUNTU-CVE-2026-41579 |
| Ubuntu:26.10 | runc | no fix listed | UBUNTU-CVE-2026-41579 |
| Ubuntu:22.04:LTS | runc-app | no fix listed | UBUNTU-CVE-2026-41579 |
| Ubuntu:24.04:LTS | runc-app | no fix listed | UBUNTU-CVE-2026-41579 |
| Ubuntu:25.10 | runc-app | no fix listed | UBUNTU-CVE-2026-41579 |
| Ubuntu:26.04:LTS | runc-app | no fix listed | UBUNTU-CVE-2026-41579 |
| Ubuntu:26.10 | runc-app | no fix listed | UBUNTU-CVE-2026-41579 |
| Ubuntu:25.10 | runc-stable | no fix listed | UBUNTU-CVE-2026-41579 |
| Ubuntu:26.04:LTS | runc-stable | no fix listed | UBUNTU-CVE-2026-41579 |
| Ubuntu:26.10 | runc-stable | no fix listed | UBUNTU-CVE-2026-41579 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| opencontainers | runc | < 1.3.6>= 1.4.0-rc.1, < 1.4.3>= 1.5.0-rc.1, < 1.5.0-rc.3 |
Weakness: CWE-61 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
References
- https://github.com/opencontainers/runc/security/advisories/GHSA-xjvp-4fhw-gc47 x_refsource_CONFIRM
- https://github.com/opencontainers/runc/commit/864db8042dbb x_refsource_MISC