CVE-2026-88265: crun 1.29.1 and below pivot_root stdio symlink issue
CVE-2026-88265 Published on September 10, 2026
Crun: crun: /dev/null symlink follow during stdio reopen allows host bind-mount write and chown
A flaw was found in crun. After pivot_root, reopening /dev/null for stdio can follow a symlink and attach a host file to container stdio, then change that file's ownership. Affected versions are crun 1.29.1 and earlier. Default configurations that mount a fresh /dev are not exposed. No fixed release is available yet.
Vulnerability Analysis
CVE-2026-88265 can be exploited with local system access, and requires small amount of user privileges. This vulnerability is consided to have a high level of attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality, a high impact on integrity, and no impact on availability.
Timeline
Reported to Red Hat.
Made public.
Weakness Type
What is an insecure temporary file Vulnerability?
The software attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
CVE-2026-88265 has been classified to as an insecure temporary file vulnerability or weakness.
Products Associated with CVE-2026-88265
Want to know whenever a new CVE is published for Red Hat Hummingbird? stack.watch will email you.
