Kata Containers CVE-2026-64676

Exploitation requires two explicit preconditions: (1) the mem-agent feature must be explicitly enabled by the operator - it is off by default, so the vast majority of kata-containers deployments are not affected; (2) the deployment must be a Confidential Containers (CoCo) configuration where the host is treated as untrusted and the kata-agent's AgentPolicy is the enforced security boundary. Without mem-agent enabled, the vulnerable ttRPC methods do not exist in the attack surface. The CVSS vector specifies PR:N for the attacker, meaning no credential or privilege within the guest is required - the host-side caller bypasses the guest's policy gate unconditionally. Exploitation is limited to availability and integrity degradation (forced swap, eviction, compaction); the description explicitly states that memory disclosure and code execution are outside the impact scope. Non-CoCo kata-containers deployments, which do not rely on the AgentPolicy as a security boundary between host and guest, are not meaningfully impacted.

The CVSS 3.1 score of 5.7 (AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L) reflects a Scope Changed scenario where the host (attacker) affects the confidential guest (victim), but impact is bounded to limited integrity and availability - no confidentiality breach. The AV:L vector is appropriate because exploitation requires the attacker to already control the host infrastructure, which is the defined adversarial role in the CoCo threat model. EPSS data was not provided, and there is no KEV listing, nor any identified public proof-of-concept, so exploitation probability signals are absent. The RCE tag supplied with this CVE is inconsistent with the description, which explicitly excludes code execution - this discrepancy should be treated as a tagging error, not a confirmed capability. The critical qualifying condition is that mem-agent must be explicitly enabled by the operator; with mem-agent off (the default), these ttRPC methods are not exposed and the vulnerability is not reachable. For CoCo deployments with mem-agent enabled, the risk is real but bounded: an adversarial cloud host can degrade or destabilize confidential workloads without violating data confidentiality. This makes the vulnerability relevant specifically to threat models where the cloud provider or hypervisor host is considered a potential adversary, which is precisely the CoCo use case.

An attacker with control over the host infrastructure (e.g., a compromised hypervisor or malicious cloud operator) targets a CoCo tenant that has enabled mem-agent on kata-containers prior to 4.0.0. The host sends ttRPC calls to the kata-agent invoking the unguarded mem-agent API methods - without passing through or being evaluated by the guest's OPA/Rego AgentPolicy - to repeatedly force aggressive memory eviction or compaction inside the guest VM. The confidential workload experiences severe memory pressure, performance degradation, or availability disruption, all without leaving the guest's policy control path. No public proof-of-concept code has been identified at time of analysis.