CVE-2026-41579 Details
Description
runc is a CLI tool for spawning and running containers according to the OCI specification. In versions prior to 1.3.6, 1.4.0-rc.1, 1.4.0-rc.12, 1.5.0-rc.1, and 1.5.0-rc.1, when setting up the container rootfs, setupPtmx and setupDevSymlinks call os.Remove and os.Symlink with a filepath.Join string which allow an image with /dev as a symlink to trick runc into deleting files called ptmx on the host or creating a hardcoded set of symlinks with specific names and targets in an arbitrary pre-existing host directory. This issue is not exploitable under Docker, because Docker creates a top-level read-only layer that masks any malicious /dev symlink present in the container image — unlike some other Linux container tooling, whose higher-level runtimes built on runc remain exposed to exploitation via a malicious image. This issue has been fixed in versions 1.3.6, 1.4.3 and 1.5.0.
A vulnerability in runc, a tool for managing containers according to the OCI specification, allows for limited host file system integrity violations. This issue is present in runc versions prior to 1.3.6, 1.4.0-rc.1, 1.4.0-rc.12, 1.5.0-rc.1, and 1.5.0-rc.2. The vulnerability arises when the container root file system is being set up. The functions 'setupPtmx' and 'setupDevSymlinks' improperly handle symlinks in a way that can lead to the deletion of specific files on the host or the creation of unwanted symlinks in arbitrary directories. While this vulnerability is not exploitable through Docker due to its read-only layer that masks such malicious symlinks, it can be exploited in other container runtimes like Podman and containerd that do not have similar protections.
Users can upgrade to runc versions 1.3.6, 1.4.3, or 1.5.0-rc.3 to address this vulnerability. For those using containerd, ensure that the version in use does not contain the vulnerable runc version.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 1, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/opencontainers/runc/commit/864db8042dbb | [email protected] | Patch |
| https://github.com/opencontainers/runc/security/advisories/GHSA-xjvp-4fhw-gc47 | [email protected] | MitigationPatchVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-61 | UNIX Symbolic Link (Symlink) Following | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linuxfoundation runc | < 1.3.6 >= 1.4.0, < 1.4.3 1.5.0 rc1 1.5.0 rc2 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 2, 2026 | Initial Analysis | [email protected] |
| Jul 1, 2026 | CVE Modified | CISA-ADP |
| Jul 1, 2026 | New CVE Received | [email protected] |