Kata Containers CVE-2026-24834

Requires the Kata Containers runtime configured with the Cloud Hypervisor (CLH) backend using the default virtio-pmem/DAX rootfs driver, and an attacker who is already a user inside the container with sufficient permissions to open and write the /dev/pmem0 device (PR:L, local AV:L, no user interaction). Exploitation is LIMITED to the attacker's own guest VM on x86 - the advisory states the host and other VMs/containers are not impacted, and on most platforms persisted writes do not reach the backing image. A notable broadening condition: on arm64 with QEMU, which lacks NVDIMM read-only support, a guest write could reach the underlying image file, increasing impact. Configurations using QEMU with proper NVDIMM read-only support, confidential guests (TDX, which already used virtio-blk), or version 3.27.0+ are not affected.

Signals are mixed and should be weighed carefully. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:C, C:H/I:H/A:H, base 8.8) reflects a local, low-complexity attack by a low-privileged container user that crosses a trust boundary (scope change) to full compromise of the guest VM. However, EPSS is only 0.01% (3rd percentile) and the issue is NOT on CISA KEV, indicating no observed widespread exploitation. A GitHub advisory with technical PoC detail exists (publicly available exploit code exists), but PoC availability is distinct from active exploitation. Critically, the impact is bounded: per the advisory's current understanding, the attacker only gains root in their own already-sandboxed guest VM and does NOT compromise the host or neighboring VMs/containers - so on x86 the practical blast radius is the attacker's own sandbox. One important caveat the data flags explicitly: arm64 QEMU lacks NVDIMM read-only support, so on that platform a guest write could reach the underlying image file - verify platform exposure before deprioritizing. Net: real and worth patching, but lower urgency than the 8.8 score alone suggests for x86 Cloud Hypervisor deployments.

An attacker who controls a process inside a Kata-managed container on a Cloud Hypervisor host opens /dev/pmem0 (the DAX-mapped guest rootfs) and writes to it; because the region is never enforced read-only, the writes land in guest memory and are read back, letting the attacker tamper with the guest root filesystem and execute code as root in their micro-VM. Technical PoC detail is published in the GHSA advisory. The attack is local (AV:L) and low-complexity (AC:L) but requires existing low-privilege access inside the container.