CVE-2026-93316: Starting daemon with --cdi-disabled flag can lead to panic on specific builds

Severity: high (CVSS 7.1 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-05 · updated 2026-10-06
Weakness: CWE-476

Description

If BuildKit daemon is started with --cdi-disabled it can lead to daemon panic when builds try to use CDI devices. This can happen maliciously or by accident.

Affected products

moby BuildKit: before 0.33.1 — fixed in 0.33.1

How to fix

Upgrade to a fixed version: moby BuildKit 0.33.1. Check the vendor advisory for mitigations.

References

https://github.com/moby/buildkit/releases/tag/v0.33.1
https://github.com/moby/buildkit/security/advisories/GHSA-r456-g3gm-cvxf

Get alerted when CVE-2026-93316 or the next vulnerability affects your stack