Kata Containers
CVE-2026-24834
HIGH
GHSA-wwj6-vghv-5p64
Severity by source
AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Local container user (AV:L, PR:L) escalates across the container-to-VM boundary (S:C) to full root control of the guest (C:H/I:H/A:H); matches vendor scoring of 8.8.
AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
12DescriptionNVD
Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines (VMs) that perform like containers. In versions prior to 3.27.0, an issue in Kata with Cloud Hypervisor allows a user of the container to modify the file system used by the Guest micro VM ultimately achieving arbitrary code execution as root in said VM. The current understanding is this doesn’t impact the security of the Host or of other containers / VMs running on that Host (note that arm64 QEMU lacks NVDIMM read-only support: It is believed that until the upstream QEMU gains this capability, a guest write could reach the image file). Version 3.27.0 patches the issue.
AnalysisAI
Privilege escalation in Kata Containers (versions prior to 3.27.0) running on the Cloud Hypervisor backend lets a sufficiently-privileged container user write to the guest micro-VM's root filesystem and gain arbitrary code execution as root inside that VM. The root cause is that the read-only DAX/virtio-pmem rootfs image is never actually enforced read-only, so guest writes to /dev/pmem0 are observed by the guest. Publicly available exploit detail exists (GitHub Security Advisory GHSA-wwj6-vghv-5p64), though EPSS exploitation probability is negligible (0.01%) and it is not on CISA KEV.
Technical ContextAI
Kata Containers boots each pod inside a lightweight VM, DAX-mapping the guest rootfs image from the host directly into guest memory and mounting it as /dev/pmem0. The CWE-732 (incorrect/incomplete permission assignment to a critical resource) flaw arises across three layers: the Linux virtio-pmem driver registers the region as a writable pagemap and never sets nd_region->ro, so nvdimm_check_and_set_ro() is a no-op and the block device stays read/write; Cloud Hypervisor's discard_writes=on intends to make backing writes ineffective via MAP_PRIVATE copy-on-write, but the guest still reads back its own modified private pages; and because DAX maps the file directly into guest memory, the hypervisor cannot intercept or reject individual stores. The CPE cpe:2.3:a:katacontainers:kata_containers confirms the affected component is the Kata runtime, specifically the runtime-rs Cloud Hypervisor convert path that selected virtio-pmem (PmemConfig) for the standard guest image.
RemediationAI
Upgrade to Kata Containers 3.27.0, which is the vendor-released patch (commit 6a672503973bf7c687053e459bfff8a9652e16bf); the fix stops using virtio-pmem for the Cloud Hypervisor rootfs and switches to virtio-blk-pci (VMROOTFSDRIVER_CLH changed to virtio-blk-pci, and set_hypervisor_config now coerces a configured pmem rootfs driver to block), so the guest can no longer write through the DAX mapping. Consult the advisory at https://github.com/kata-containers/kata-containers/security/advisories/GHSA-wwj6-vghv-5p64 and apply your distribution's update (SUSE-SU-2026:0757, or the Red Hat VEX at https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-24834.json). If you cannot upgrade immediately, a targeted compensating control is to switch the rootfs driver away from virtio-pmem to virtio-blk (virtio-blk-pci) in the Cloud Hypervisor configuration.toml, which mirrors the upstream fix; note this changes the boot device model and may have minor I/O performance characteristics versus DAX/pmem. Restrict which workloads run on the Cloud Hypervisor backend and avoid the arm64/QEMU NVDIMM path where a guest write could reach the image file, since that variant has greater impact.
More in Kata Containers
View allSandbox escape in Kata Containers allowing guest VM to access host resources. CVSS 10.0 — undermines the core security g
An issue was discovered in Kata Containers through 1.11.3 and 2.x through 2.0-rc1. Rated high severity (CVSS 8.8), this
Arbitrary file write in Kata Containers v3.4.0 to v3.28.0 allows untrusted hosts to overwrite binaries and exfiltrate da
An improper file permissions vulnerability affects Kata Containers prior to 1.11.5. Rated high severity (CVSS 7.1), this
Vendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| openSUSE Leap 15.6 | Fixed |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Fixed |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Fixed |
| openSUSE Leap 15.5 | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today