CVE catalog
CVE-2026-41579
runc is a CLI tool for spawning and running containers…
runc is a CLI tool for spawning and running containers according to the OCI specification. In versions prior to 1.3.6, 1.4.0-rc.1, 1.4.0-rc.12, 1.5.0-rc.1, and 1.5.0-rc.1, when setting up the container rootfs, setupPtmx and setupDevSymlinks call os.Remove and os.Symlink with a filepath.Join string which allow an image with /dev as a symlink to trick runc into deleting files called ptmx on the host or creating a hardcoded set of symlinks with specific names and targets in an arbitrary pre-existing host directory. This issue is not exploitable under Docker, because Docker creates a top-level read-only layer that masks any malicious /dev symlink present in the container image — unlike some other Linux container tooling, whose higher-level runtimes built on runc remain exposed to exploitation via a malicious image. This issue has been fixed in versions 1.3.6, 1.4.3 and 1.5.0.
- Severity
- Low · CVSS 3.6
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 0.19% · Oct 27, 2026
Projects and upstream resources
Reported versions and fixes
Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.
Version impact has not been established. The original provider fields are retained below.
Provider details and historical evidence
Original provider fields
{
"package_releases": [
{
"name": "runc",
"status": "fixed",
"release": "sid",
"version": "1.3.6+ds1-1"
},
{
"name": "runc",
"status": "fixed",
"release": "forky",
"version": "1.3.6+ds1-1"
},
{
"name": "runc",
"status": "vulnerable",
"release": "trixie",
"version": "1.1.15+ds1-2"
},
{
"name": "runc",
"status": "vulnerable",
"release": "bookworm",
"version": "1.1.5+ds1-1+deb12u1"
},
{
"name": "runc",
"status": "vulnerable",
"release": "bookworm-security",
"version": "1.1.5+ds1-1+deb12u1"
}
],
"fixed_versions": [
{
"bug": 1140000,
"name": "runc",
"type": "source",
"origin": null,
"release": "sid",
"urgency": "not yet assigned",
"fixed_version": "1.3.6+ds1-1"
},
{
"bug": 1140000,
"name": "runc",
"type": "source",
"origin": null,
"release": "forky",
"urgency": "not yet assigned",
"fixed_version": "1.3.6+ds1-1"
},
{
"bug": 1140000,
"name": "runc",
"type": "source",
"origin": null,
"release": "trixie",
"urgency": "not yet assigned",
"fixed_version": ""
},
{
"bug": 1140000,
"name": "runc",
"type": "source",
"origin": null,
"release": "bookworm",
"urgency": "not yet assigned",
"fixed_version": ""
}
],
"distribution_packages": [
{
"name": "runc",
"ecosystem": "cpe",
"fixed_version": "not yet fixed"
},
{
"name": "runc",
"ecosystem": "cpe",
"fixed_version": "1.3.6"
},
{
"name": "runc",
"ecosystem": "cpe",
"fixed_version": "1.4.3"
},
{
"name": "runc",
"ecosystem": "cpe",
"fixed_version": ""
},
{
"name": "github.com/opencontainers/runc",
"ecosystem": "Go",
"fixed_version": "1.5.0-rc.3"
},
{
"name": "runc",
"distro": "suse",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.3.6-slfo.1.1_1.1"
}
]
}
],
"release": "linux micro 6.1",
"versions": [],
"ecosystem": "rpm",
"fixed_version": "1.3.6-slfo.1.1_1.1",
"provider_record_id": "SUSE-SU-2026:23164-1"
},
{
"name": "runc",
"distro": "suse",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.3.6-1.1"
}
]
}
],
"release": "linux micro 6.0",
"versions": [],
"ecosystem": "rpm",
"fixed_version": "1.3.6-1.1",
"provider_record_id": "SUSE-SU-2026:23047-1"
},
{
"name": "runc",
"distro": "suse",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.3.6-150000.101.1"
}
]
}
],
"release": "linux enterprise high performance computing 15 sp4-espos",
"versions": [],
"ecosystem": "rpm",
"fixed_version": "1.3.6-150000.101.1",
"provider_record_id": "SUSE-SU-2026:3433-2"
},
{
"name": "runc",
"distro": "suse",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.3.6-150000.101.1"
}
]
}
],
"release": "linux enterprise high performance computing 15 sp4-ltss",
"versions": [],
"ecosystem": "rpm",
"fixed_version": "1.3.6-150000.101.1",
"provider_record_id": "SUSE-SU-2026:3433-2"
},
{
"name": "runc",
"distro": "suse",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.3.6-150000.101.1"
}
]
}
],
"release": "linux enterprise high performance computing 15 sp5-espos",
"versions": [],
"ecosystem": "rpm",
"fixed_version": "1.3.6-150000.101.1",
"provider_record_id": "SUSE-SU-2026:3433-2"
},
{
"name": "runc",
"distro": "suse",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.3.6-150000.101.1"
}
]
}
],
"release": "linux enterprise high performance computing 15 sp5-ltss",
"versions": [],
"ecosystem": "rpm",
"fixed_version": "1.3.6-150000.101.1",
"provider_record_id": "SUSE-SU-2026:3433-2"
},
{
"name": "runc",
"distro": "suse",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.3.6-150000.101.1"
}
]
}
],
"release": "linux enterprise server 15 sp4-ltss",
"versions": [],
"ecosystem": "rpm",
"fixed_version": "1.3.6-150000.101.1",
"provider_record_id": "SUSE-SU-2026:3433-2"
},
{
"name": "runc",
"distro": "suse",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.3.6-150000.101.1"
}
]
}
],
"release": "linux enterprise server 15 sp5-ltss",
"versions": [],
"ecosystem": "rpm",
"fixed_version": "1.3.6-150000.101.1",
"provider_record_id": "SUSE-SU-2026:3433-2"
},
{
"name": "runc",
"distro": "suse",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.3.6-150000.101.1"
}
]
}
],
"release": "linux enterprise server 15 sp6-ltss",
"versions": [],
"ecosystem": "rpm",
"fixed_version": "1.3.6-150000.101.1",
"provider_record_id": "SUSE-SU-2026:3433-2"
},
{
"name": "runc",
"distro": "suse",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.3.6-150000.101.1"
}
]
}
],
"release": "linux enterprise server for sap applications 15 sp4",
"versions": [],
"ecosystem": "rpm",
"fixed_version": "1.3.6-150000.101.1",
"provider_record_id": "SUSE-SU-2026:3433-2"
},
{
"name": "runc",
"distro": "suse",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.3.6-150000.101.1"
}
]
}
],
"release": "linux enterprise server for sap applications 15 sp5",
"versions": [],
"ecosystem": "rpm",
"fixed_version": "1.3.6-150000.101.1",
"provider_record_id": "SUSE-SU-2026:3433-2"
},
{
"name": "runc",
"distro": "suse",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.3.6-150000.101.1"
}
]
}
],
"release": "linux enterprise server for sap applications 15 sp6",
"versions": [],
"ecosystem": "rpm",
"fixed_version": "1.3.6-150000.101.1",
"provider_record_id": "SUSE-SU-2026:3433-2"
},
{
"name": "runc",
"distro": "suse",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.3.6-16.76.1"
}
]
}
],
"release": "linux enterprise server 12 sp5-ltss",
"versions": [],
"ecosystem": "rpm",
"fixed_version": "1.3.6-16.76.1",
"provider_record_id": "SUSE-SU-2026:3428-2"
},
{
"name": "runc",
"distro": "opensuse",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.4.3-1.1"
}
]
}
],
"release": "tumbleweed",
"versions": [],
"ecosystem": "rpm",
"fixed_version": "1.4.3-1.1",
"provider_record_id": "OPENSUSE-SU-2026:11301-1"
},
{
"name": "runc",
"ranges": [],
"ecosystem": "cpe",
"fixed_version": "",
"provider_record_id": "NVD-CVE-2026-41579"
}
]
}OpenFactory catalog packages
Matching against OpenFactory catalog package versions is in progress.
[Debian 12 (Bookworm)]
Source package: [runc]
Details (4)
1.1.5+ds1-1+deb12u1· all · bookwormAffected
nvd · runc · debian · bookworm; nvd · runc · debian · 12
1.1.5+ds1-1+deb12u1· all · bookwormAffected
nvd · runc · debian · bookworm; nvd · runc · debian · 12
1.1.5+ds1-1+deb12u1· all · bookworm-securityAffected
nvd · runc · debian · bookworm; nvd · runc · debian · 12
1.1.5+ds1-1+deb12u1· all · bookworm-securityAffected
nvd · runc · debian · bookworm; nvd · runc · debian · 12
- [runc]Unknown
Details (4)
1.1.5+ds1-1+deb12u1· amd64 · bookwormAffected
nvd · runc · debian · bookworm; nvd · runc · debian · 12
1.1.5+ds1-1+deb12u1· arm64 · bookwormAffected
nvd · runc · debian · bookworm; nvd · runc · debian · 12
1.1.5+ds1-1+deb12u1· amd64 · bookworm-securityAffected
nvd · runc · debian · bookworm; nvd · runc · debian · 12
1.1.5+ds1-1+deb12u1· arm64 · bookworm-securityAffected
nvd · runc · debian · bookworm; nvd · runc · debian · 12
[Debian 13 (Trixie)]
Source package: [runc]
Details (2)
1.1.15+ds1-2· all · trixieAffected
nvd · runc · debian · 13
1.1.15+ds1-2· all · trixieAffected
nvd · runc · debian · 13
- [runc]Unknown
Source package: [runc]
Details (2)
1.1.15+ds1-2+b4· amd64 · trixieAffected
nvd · runc · debian · 13
1.1.15+ds1-2+b4· arm64 · trixieAffected
nvd · runc · debian · 13
[openSUSE Tumbleweed]
Observed:
References
- [https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_11301-1.json]
- [https://github.com/opencontainers/runc/commit/864db8042dbb]
- [https://github.com/opencontainers/runc/security/advisories/GHSA-xjvp-4fhw-gc47]
- [https://nvd.nist.gov/vuln/detail/CVE-2026-41579]
- [https://osv.dev/vulnerability/DEBIAN-CVE-2026-41579]
- [https://osv.dev/vulnerability/SUSE-SU-2026:23047-1]
- [https://osv.dev/vulnerability/SUSE-SU-2026:23164-1]
- [https://osv.dev/vulnerability/SUSE-SU-2026:3428-2]
- [https://osv.dev/vulnerability/SUSE-SU-2026:3433-2]
- [https://osv.dev/vulnerability/openSUSE-SU-2026:11301-1]
- [https://pkg.go.dev/vuln/GO-2026-5761]
- [https://security-tracker.debian.org/tracker/CVE-2026-41579]
- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41579.json]
[Debian Security Tracker] · [FIRST EPSS] · [Go Vulnerability Database] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]