CVE-2026-88265 — Crun: crun: /dev/null symlink follow during stdio reopen allows host bind-mount write and chown
A flaw was found in crun. After pivot_root, reopening /dev/null for stdio can follow a symlink and attach a host file to container stdio, then change that file's ownership. Affe…
Published: 2026-09-10 · CVSS: 5.6 · CVSS 3.1
A flaw was found in crun. After pivot_root, reopening /dev/null for stdio can follow a symlink and attach a host file to container stdio, then change that file's ownership. Affected versions are crun 1.29.1 and earlier. Default configurations that mount a fresh /dev are not exposed. No fixed release is available yet.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7