CVE-2026-41579: runc: Malicious image with /dev symlink can trigger limited host filesystem integrity violations

Severity: low (CVSS 3.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-07-01 · updated 2026-10-25
Weakness: CWE-61

Description

runc is a CLI tool for spawning and running containers according to the OCI specification. In versions prior to 1.3.6, 1.4.0-rc.1, 1.4.0-rc.12, 1.5.0-rc.1, and 1.5.0-rc.1, when setting up the container rootfs, setupPtmx and setupDevSymlinks call os.Remove and os.Symlink with a filepath.Join string which allow an image with /dev as a symlink to trick runc into deleting files called ptmx on the host or creating a hardcoded set of symlinks with specific names and targets in an arbitrary pre-existing host directory. This issue is not exploitable under Docker, because Docker creates a top-level read-only layer that masks any malicious /dev symlink present in the container image — unlike some other Linux container tooling, whose higher-level runtimes built on runc remain exposed to exploitation via a malicious image. This issue has been fixed in versions 1.3.6, 1.4.3 and 1.5.0.

Affected products

opencontainers runc: before 1.3.6; from 1.4.0 before 1.4.3; 1.5.0-rc1, 1.5.0-rc2 — fixed in 1.3.6, 1.4.3

How to fix

Upgrade to a fixed version: opencontainers runc 1.3.6, 1.4.3. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-41579 or the next vulnerability affects your stack