crun CVE-2026-88265

Exploitation requires that the container runtime does NOT mount a fresh tmpfs /dev at container start - the CVE description explicitly states 'Default configurations that mount a fresh /dev are not exposed.' The vulnerable condition is a non-default deployment where the host /dev or a pre-populated /dev is visible inside the container at the time of pivot_root execution. The attacker must have low-privilege code execution inside the container (PR:L) and must be able to create or replace /dev/null with a symlink before crun's stdio reopen step. Exploitation is further constrained by AC:H: the attacker must win a timing window around the pivot_root/stdio-reopen sequence. Factors limiting exploitation: default OCI container configurations are immune; the attacker needs an already-running container session; no network-reachable vector exists (AV:L).

The CVSS 3.1 vector AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:N scores 5.6 (Medium), and the signal set supports treating this as a genuine but conditional risk. AC:H is grounded in the explicit caveat in the description: 'Default configurations that mount a fresh /dev are not exposed.' Only deployments where a host or pre-seeded /dev is bind-mounted into the container - a non-default arrangement - are vulnerable. The scope-change (S:C) and I:H reflect a real host integrity impact (chown of an arbitrary host file), which could be escalated to privilege escalation if an attacker chowns a sensitive SUID binary or configuration file. PR:L is appropriate: a low-privilege container process can execute this. No EPSS data is available; no KEV listing; no public exploit identified. The Red Hat Bugzilla reference confirms vendor acknowledgment. The combination of non-default configuration requirement and AC:H appropriately limits real-world exposure, but environments using custom /dev mounts (e.g., device-passthrough workloads, privileged containers with host /dev) should treat this as a higher-priority finding given the scope change.

A low-privileged process inside a container running on a non-default /dev configuration replaces /dev/null with a symbolic link pointing to a sensitive host file (e.g., /etc/passwd or a SUID binary). When crun performs its post-pivot_root stdio reopen, it follows the symlink to the host file, attaches it to container stdio, and calls chown to transfer ownership to the container UID. The attacker can then leverage ownership of the host file for subsequent privilege escalation on the host.