CVE-2026-84042 — Crun: crun: rootful krun with passt executes container payload as host root
A flaw was found in crun. When crun is built with libkrun and a container is started rootful with passt networking (krun.use_passt), crun can execute attacker-controlled payload…
Published: 2026-09-10 · CVSS: 7.8 · CVSS 3.1
A flaw was found in crun. When crun is built with libkrun and a container is started rootful with passt networking (krun.use_passt), crun can execute attacker-controlled payload from the container image with host root privileges. The issue is a regression in crun 1.29. It affects crun >= 1.29
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7