CVE-2026-88264 — Crun: crun: /dev/console symlink follow allows root-owned file creation outside the rootfs
A flaw was found in crun. When the container configuration does not give /dev a dedicated mount, terminal setup can redirect /dev/console onto an attacker-controlled path, inclu…
Published: 2026-09-10 · CVSS: 5.6 · CVSS 3.1
A flaw was found in crun. When the container configuration does not give /dev a dedicated mount, terminal setup can redirect /dev/console onto an attacker-controlled path, including via the read-only-rootfs bind-mount fallback. Affected versions are crun 1.29.1 and earlier. Default configurations that mount a fresh /dev are not exposed. No fixed release is available yet.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7