CVE catalog

CVE-2025-52881

runC vulnerabilities

[CVE catalog]

Severity
High · CVSS 8.2CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Published
Source
[NVD] · [CVE record]
EPSS
0.80% · Oct 25, 2026

runc is a CLI tool for spawning and running containers according to the OCI specification. In versions 1.2.7, 1.3.2 and 1.4.0-rc.2, an attacker can trick runc into misdirecting writes to /proc to other procfs files through the use of a racing container with shared mounts (we have also verified this attack is possible to exploit using a standard Dockerfile with docker buildx build as that also permits triggering parallel execution of containers with custom shared mounts configured). This redirect could be through symbolic links in a tmpfs or theoretically other methods such as regular bind-mounts. While similar, the mitigation applied for the related CVE, CVE-2019-19921, was fairly limited and effectively only caused runc to verify that when LSM labels are written they are actually procfs files. This issue is fixed in versions 1.2.8, 1.3.3, and 1.4.0-rc.3.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianruncsid1.3.6+ds1-1fixed
Debianruncforky1.3.6+ds1-1fixed
Debianrunctrixie1.1.15+ds1-2vulnerable
Debianruncbookworm1.1.5+ds1-1+deb12u1vulnerable
Debianruncbookworm-security1.1.5+ds1-1+deb12u1vulnerable
UbunturuncnobleNot reportedvulnerable
Ubunturunc-appnoble1.3.3-0ubuntu1~24.04.2fixed
Ubunturuncnoble1.3.3-0ubuntu1~24.04.2fixed
CperuncNot reportedNot reportedunknown
Opensusepodmantumbleweed5.7.1-1.1fixed
Opensusebuildahtumbleweed1.42.2-1.1fixed
Opensuseincustumbleweed6.17-2.1fixed
Susebuildahlinux enterprise high performance computing 15 sp4-espos1.35.5-150400.3.53.1fixed
Susebuildahlinux enterprise high performance computing 15 sp4-ltss1.35.5-150400.3.53.1fixed
Susebuildahlinux enterprise server 15 sp4-ltss1.35.5-150400.3.53.1fixed
Susebuildahlinux enterprise server for sap applications 15 sp41.35.5-150400.3.53.1fixed
Susebuildahlinux enterprise module for containers 15 sp61.35.5-150500.3.45.1fixed
Susebuildahlinux enterprise module for containers 15 sp71.35.5-150500.3.45.1fixed
Susebuildahlinux enterprise high performance computing 15 sp5-espos1.35.5-150500.3.45.1fixed
Susebuildahlinux enterprise high performance computing 15 sp5-ltss1.35.5-150500.3.45.1fixed
Susebuildahlinux enterprise server 15 sp5-ltss1.35.5-150500.3.45.1fixed
Susebuildahlinux enterprise server for sap applications 15 sp51.35.5-150500.3.45.1fixed
Opensusebuildahleap 15.61.35.5-150500.3.45.1fixed
Susebuildahlinux enterprise high performance computing 15 sp3-ltss1.35.5-150300.8.46.1fixed
Susebuildahlinux enterprise server 15 sp3-ltss1.35.5-150300.8.46.1fixed
Susebuildahlinux enterprise server for sap applications 15 sp31.35.5-150300.8.46.1fixed
Susebuildahenterprise storage 7.11.35.5-150300.8.46.1fixed
Ubunturuncpro1.0.0~rc2+docker1.13.1-0ubuntu1vulnerable
Ubunturuncpro1.0.0~rc4+dfsg1-2vulnerable
Ubunturuncpro1.0.0~rc4+dfsg1-6vulnerable
Ubunturuncpro1.0.0~rc4+dfsg1-6ubuntu0.18.04.1vulnerable
Ubunturuncpro1.0.0~rc7+git20190403.029124da-0ubuntu1~18.04.1vulnerable
Ubunturuncpro1.0.0~rc7+git20190403.029124da-0ubuntu1~18.04.2vulnerable
Ubunturuncpro1.0.0~rc7+git20190403.029124da-0ubuntu1~18.04.2+esm1vulnerable
Ubunturuncpro1.0.0~rc10-0ubuntu1~18.04.1vulnerable
Ubunturuncpro1.0.0~rc10-0ubuntu1~18.04.2vulnerable
Ubunturuncpro1.0.0~rc93-0ubuntu1~18.04.1vulnerable
Ubunturuncpro1.0.0~rc93-0ubuntu1~18.04.2vulnerable
Ubunturuncpro1.0.0~rc95-0ubuntu1~18.04.1vulnerable
Ubunturuncpro1.0.0~rc95-0ubuntu1~18.04.2vulnerable
Ubunturuncpro1.0.1-0ubuntu2~18.04.1vulnerable
Ubunturuncpro1.1.0-0ubuntu1~18.04.1vulnerable
Ubunturuncpro1.1.4-0ubuntu1~18.04.1vulnerable
Ubunturuncpro1.1.4-0ubuntu1~18.04.2vulnerable
Ubunturuncpro1.1.4-0ubuntu1~18.04.2+esm1vulnerable
Ubunturunc20.041.0.0~rc8+git20190923.3e425f80-0ubuntu1vulnerable
Ubunturunc20.041.0.0~rc10-0ubuntu1vulnerable
Ubunturunc20.041.0.0~rc93-0ubuntu1~20.04.1vulnerable
Ubunturunc20.041.0.0~rc93-0ubuntu1~20.04.2vulnerable
Ubunturunc20.041.0.0~rc95-0ubuntu1~20.04.1vulnerable
Ubunturunc20.041.0.0~rc95-0ubuntu1~20.04.2vulnerable
Ubunturunc20.041.0.1-0ubuntu2~20.04.1vulnerable
Ubunturunc20.041.1.0-0ubuntu1~20.04.1vulnerable
Ubunturunc20.041.1.0-0ubuntu1~20.04.2vulnerable
Ubunturunc20.041.1.4-0ubuntu1~20.04.1vulnerable
Ubunturunc20.041.1.4-0ubuntu1~20.04.2vulnerable
Ubunturunc20.041.1.4-0ubuntu1~20.04.3vulnerable
Ubunturunc20.041.1.7-0ubuntu1~20.04.1vulnerable
Ubunturunc20.041.1.7-0ubuntu1~20.04.2vulnerable
Ubunturunc20.041.1.7-0ubuntu1~20.04.4vulnerable
Ubunturunc20.041.1.7-0ubuntu1~20.04.5vulnerable
Ubunturunc-app20.041.1.12-0ubuntu2~20.04.1vulnerable
Ubunturunc22.041.0.1-0ubuntu2vulnerable
Ubunturunc22.041.0.1-0ubuntu3vulnerable
Ubunturunc22.041.0.3-0ubuntu1vulnerable
Ubunturunc22.041.1.0-0ubuntu1vulnerable
Ubunturunc22.041.1.0-0ubuntu1.1vulnerable
Ubunturunc22.041.1.4-0ubuntu1~22.04.1vulnerable
Ubunturunc22.041.1.4-0ubuntu1~22.04.2vulnerable
Ubunturunc22.041.1.4-0ubuntu1~22.04.3vulnerable
Ubunturunc22.041.1.7-0ubuntu1~22.04.1vulnerable
Ubunturunc22.041.1.7-0ubuntu1~22.04.2vulnerable
Ubunturunc22.041.1.7-0ubuntu1~22.04.4vulnerable
Ubunturunc22.041.1.7-0ubuntu1~22.04.5vulnerable
Ubunturunc22.041.1.7-0ubuntu1~22.04.6vulnerable
Ubunturunc-app22.041.1.12-0ubuntu2~22.04.1vulnerable
Ubunturunc-app22.041.2.5-0ubuntu1~22.04.1vulnerable
Ubunturunc-app22.041.3.0-0ubuntu2~22.04.1vulnerable
Ubunturunc-app22.041.3.3-0ubuntu1~22.04.2fixed
Ubunturunc24.041.1.7-0ubuntu2vulnerable
Ubunturunc24.041.1.10+ds1-1ubuntu1vulnerable
Ubunturunc24.041.1.10+ds1-1ubuntu2vulnerable
Ubunturunc24.041.1.12+ds1-1ubuntu1vulnerable
Ubunturunc24.041.1.12+ds1-2ubuntu1vulnerable
Ubunturunc24.041.1.12+ds1-2ubuntu1.1vulnerable
Ubunturunc24.041.1.12+ds1-2ubuntu1.2vulnerable
Ubunturunc24.041.1.12+ds1-2ubuntu1.3vulnerable
Ubunturunc-app24.041.1.10-0ubuntu1vulnerable
Ubunturunc-app24.041.1.12-0ubuntu1vulnerable
Ubunturunc-app24.041.1.12-0ubuntu2vulnerable
Ubunturunc-app24.041.1.12-0ubuntu3vulnerable
Ubunturunc-app24.041.1.12-0ubuntu3.1vulnerable
Ubunturunc-app24.041.2.5-0ubuntu1~24.04.1vulnerable
Ubunturunc-app24.041.3.0-0ubuntu2~24.04.1vulnerable
Ubunturunc-app24.041.3.3-0ubuntu1~24.04.2fixed
Ubunturunc25.101.1.15+ds1-2ubuntu1vulnerable
Ubunturunc-app25.101.2.5-0ubuntu1vulnerable
Ubunturunc-app25.101.3.0-0ubuntu1vulnerable
Ubunturunc-app25.101.3.0-0ubuntu2vulnerable
Ubunturunc-app25.101.3.3-0ubuntu1~25.10.2fixed
Ubunturunc-stable25.101.3.0-0ubuntu1vulnerable
Ubunturunc-stable25.101.3.3-0ubuntu1~25.10.2fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianruncsourcesid1.3.3+ds1-2not yet assignedNot reported[1120140]
Debianruncsourceforky1.3.3+ds1-2not yet assignedNot reported[1120140]
Debianruncsourcetrixie(unfixed)not yet assignedNot reported[1120140]
Debianruncsourcebookworm(unfixed)not yet assignedNot reported[1120140]
Ubunturunc-appdebnoble1.3.3-0ubuntu1~24.04.2Not reportedNot reportedNot reported
Ubunturuncdebnoble1.3.3-0ubuntu1~24.04.2Not reportedNot reportedNot reported
Opensusepodmanrpmtumbleweed5.7.1-1.1Not reportedOPENSUSE-SU-2025:15845-1Not reported
Opensusebuildahrpmtumbleweed1.42.2-1.1Not reportedOPENSUSE-SU-2025:15843-1Not reported
Opensuseincusrpmtumbleweed6.17-2.1Not reportedOPENSUSE-SU-2025:15721-1Not reported
Susebuildahrpmlinux enterprise high performance computing 15 sp4-espos1.35.5-150400.3.53.1Not reportedSUSE-SU-2025:4074-1Not reported
Susebuildahrpmlinux enterprise high performance computing 15 sp4-ltss1.35.5-150400.3.53.1Not reportedSUSE-SU-2025:4074-1Not reported
Susebuildahrpmlinux enterprise server 15 sp4-ltss1.35.5-150400.3.53.1Not reportedSUSE-SU-2025:4074-1Not reported
Susebuildahrpmlinux enterprise server for sap applications 15 sp41.35.5-150400.3.53.1Not reportedSUSE-SU-2025:4074-1Not reported
Susebuildahrpmlinux enterprise module for containers 15 sp61.35.5-150500.3.45.1Not reportedSUSE-SU-2025:4076-1Not reported
Susebuildahrpmlinux enterprise module for containers 15 sp71.35.5-150500.3.45.1Not reportedSUSE-SU-2025:4076-1Not reported
Susebuildahrpmlinux enterprise high performance computing 15 sp5-espos1.35.5-150500.3.45.1Not reportedSUSE-SU-2025:4076-1Not reported
Susebuildahrpmlinux enterprise high performance computing 15 sp5-ltss1.35.5-150500.3.45.1Not reportedSUSE-SU-2025:4076-1Not reported
Susebuildahrpmlinux enterprise server 15 sp5-ltss1.35.5-150500.3.45.1Not reportedSUSE-SU-2025:4076-1Not reported
Susebuildahrpmlinux enterprise server for sap applications 15 sp51.35.5-150500.3.45.1Not reportedSUSE-SU-2025:4076-1Not reported
Opensusebuildahrpmleap 15.61.35.5-150500.3.45.1Not reportedSUSE-SU-2025:4076-1Not reported
Susebuildahrpmlinux enterprise high performance computing 15 sp3-ltss1.35.5-150300.8.46.1Not reportedSUSE-SU-2025:4075-1Not reported
Susebuildahrpmlinux enterprise server 15 sp3-ltss1.35.5-150300.8.46.1Not reportedSUSE-SU-2025:4075-1Not reported
Susebuildahrpmlinux enterprise server for sap applications 15 sp31.35.5-150300.8.46.1Not reportedSUSE-SU-2025:4075-1Not reported
Susebuildahrpmenterprise storage 7.11.35.5-150300.8.46.1Not reportedSUSE-SU-2025:4075-1Not reported
Ubunturunc-appdeb22.041.3.3-0ubuntu1~22.04.2Not reportedUBUNTU-CVE-2025-52881Not reported
Ubunturunc-appdeb24.041.3.3-0ubuntu1~24.04.2Not reportedUBUNTU-CVE-2025-52881Not reported
Ubunturunc-appdeb25.101.3.3-0ubuntu1~25.10.2Not reportedUBUNTU-CVE-2025-52881Not reported
Ubunturunc-stabledeb25.101.3.3-0ubuntu1~25.10.2Not reportedUBUNTU-CVE-2025-52881Not reported

[Debian bug #1120140]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [golang-github-opencontainers-runc-dev]Affected

    Source package: [runc]

    Details (4)

    • 1.1.5+ds1-1+deb12u1 · all · bookworm

      Affected

      usn · runc · debian · bookworm; usn · runc · debian · 12

    • 1.1.5+ds1-1+deb12u1 · all · bookworm

      Affected

      usn · runc · debian · bookworm; usn · runc · debian · 12

    • 1.1.5+ds1-1+deb12u1 · all · bookworm-security

      Affected

      usn · runc · debian · bookworm; usn · runc · debian · 12

    • 1.1.5+ds1-1+deb12u1 · all · bookworm-security

      Affected

      usn · runc · debian · bookworm; usn · runc · debian · 12

  • [runc]Affected
    Details (4)

    • 1.1.5+ds1-1+deb12u1 · amd64 · bookworm

      Affected

      usn · runc · debian · bookworm; usn · runc · debian · 12

    • 1.1.5+ds1-1+deb12u1 · arm64 · bookworm

      Affected

      usn · runc · debian · bookworm; usn · runc · debian · 12

    • 1.1.5+ds1-1+deb12u1 · amd64 · bookworm-security

      Affected

      usn · runc · debian · bookworm; usn · runc · debian · 12

    • 1.1.5+ds1-1+deb12u1 · arm64 · bookworm-security

      Affected

      usn · runc · debian · bookworm; usn · runc · debian · 12

[Debian 13 (Trixie)]

  • [golang-github-opencontainers-runc-dev]Affected

    Source package: [runc]

    Details (2)

    • 1.1.15+ds1-2 · all · trixie

      Affected

      usn · runc · debian · 13

    • 1.1.15+ds1-2 · all · trixie

      Affected

      usn · runc · debian · 13

  • [runc]Affected

    Source package: [runc]

    Details (2)

    • 1.1.15+ds1-2+b4 · amd64 · trixie

      Affected

      usn · runc · debian · 13

    • 1.1.15+ds1-2+b4 · arm64 · trixie

      Affected

      usn · runc · debian · 13

[openSUSE Tumbleweed]

  • [incus-cli]Unknown

    Source package: [incus]

    Details (1)

    • 6.23-3.1 · x86_64 · tumbleweed

      Unknown · Fixed: 6.17-2.1

      Version impact unknown

      usn · incus · opensuse · tumbleweed

  • [incus-cli-bash-completion]Unknown

    Source package: [incus]

    Details (1)

    • 6.23-3.1 · noarch · tumbleweed

      Unknown · Fixed: 6.17-2.1

      Version impact unknown

      usn · incus · opensuse · tumbleweed

  • [incus-cli-fish-completion]Unknown

    Source package: [incus]

    Details (1)

    • 6.23-3.1 · noarch · tumbleweed

      Unknown · Fixed: 6.17-2.1

      Version impact unknown

      usn · incus · opensuse · tumbleweed

  • [incus-cli-zsh-completion]Unknown

    Source package: [incus]

    Details (1)

    • 6.23-3.1 · noarch · tumbleweed

      Unknown · Fixed: 6.17-2.1

      Version impact unknown

      usn · incus · opensuse · tumbleweed

  • [incus-tools]Unknown

    Source package: [incus]

    Details (1)

    • 6.23-3.1 · x86_64 · tumbleweed

      Unknown · Fixed: 6.17-2.1

      Version impact unknown

      usn · incus · opensuse · tumbleweed

  • [podman-docker]Unknown

    Source package: [podman]

    Details (1)

    • 6.0.2-1.1 · noarch · tumbleweed

      Unknown · Fixed: 5.7.1-1.1

      Version impact unknown

      usn · podman · opensuse · tumbleweed

  • [podman-remote]Unknown

    Source package: [podman]

    Details (1)

    • 6.0.2-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 5.7.1-1.1

      Version impact unknown

      usn · podman · opensuse · tumbleweed

  • [podmansh]Unknown

    Source package: [podman]

    Details (1)

    • 6.0.2-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 5.7.1-1.1

      Version impact unknown

      usn · podman · opensuse · tumbleweed

  • [buildah]Fixed

    Source package: [buildah]

    Details (1)

    • 1.44.0-1.1 · x86_64 · tumbleweed

      Fixed · Fixed: 1.42.2-1.1

      usn · buildah · opensuse · tumbleweed

  • [incus]Fixed

    Source package: [incus]

    Details (1)

    • 6.23-3.1 · x86_64 · tumbleweed

      Fixed · Fixed: 6.17-2.1

      usn · incus · opensuse · tumbleweed

  • [podman]Fixed

    Source package: [podman]

    Details (1)

    • 6.0.2-1.1 · x86_64 · tumbleweed

      Fixed · Fixed: 5.7.1-1.1

      usn · podman · opensuse · tumbleweed

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]