containerd CVE-2026-95837

Exploitable only on containerd 2.1.0 through pre-2.2.7 (the 2.2.x line) and 2.3.0 through pre-2.3.4, AND only when CRI checkpoint restore via CreateContainer is active - enabled by default before 2.3.4 but disabled by default afterward unless the operator sets enable_experimental_restore_via_create = true under [plugins."io.containerd.cri.v1.runtime"]. The attacker must be able to invoke CRI CreateContainer with an attacker-controlled checkpoint archive (i.e. hold orchestrator/kubelet or crictl create privileges), which per CVSS PR:L is an authenticated, privileged, local operation. Limiting factors: systems that never use CRI checkpoint restore are entirely unaffected, the feature is experimental and deprecated (removal targeted for v2.4), the vector is local rather than network, and the attacker needs the ability to supply the crafted checkpoint.

CVSS 7.8 (High) with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H indicates a local, low-complexity, authenticated (PR:L) attack with high confidentiality, integrity and availability impact. No EPSS score was provided, the CVE is not listed in CISA KEV, and no public exploit was supplied, so exploitation status is: no public exploit identified at time of analysis. Practical risk is strongly gated: the description explicitly states systems not using CRI checkpoint restore are unaffected, and the PR diff shows this restore-via-CreateContainer path is deprecated and disabled by default from v2.3.4 onward, so only deployments that opted into checkpoint/restore (forensic checkpointing, live migration, CRIU workflows) are actually exposed. Where enabled, impact is severe: a crafted checkpoint yields a process running as root with full capabilities and no seccomp while CRI status falsely reports the requested hardened config, effectively a container-isolation and privilege-escalation bypass. Signal conflict to verify: the supplied CVSS uses S:U, but because restored privileges break container confinement and can affect the host, this is better modeled as a scope change (S:C) - see assessed vector. Net: not a mass-exploitation internet-facing emergency (local vector, requires CRI create access, niche feature), but a genuine priority for any environment using CRI checkpoint restore.

An attacker who can create containers through the CRI (for example a tenant permitted to schedule pods or invoke crictl create in a cluster that uses checkpoint restore) supplies a crafted checkpoint image to CreateContainer. During restore, CRIU reinstates the process credentials, capabilities, no_new_privs and seccomp state from the checkpoint instead of enforcing the destination ContainerConfig, so the container runs as root with full capabilities and no seccomp filter while CRI status reports the requested configuration. No public exploit identified at time of analysis.