CVE catalog

CVE-2026-53492

containerd is an open-source container runtime. In Versions prior to 2.3.2, 2.2.5 and 2.1.9, the CRI implementation improperly trusts Container Device Interface (CDI) annotations found within untruste

[CVE catalog]

Severity
High · CVSS 8.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Published
Source
[NVD] · [CVE record]
EPSS
0.35% · Oct 25, 2026

containerd is an open-source container runtime. In Versions prior to 2.3.2, 2.2.5 and 2.1.9, the CRI implementation improperly trusts Container Device Interface (CDI) annotations found within untrusted checkpoint image metadata during container restoration. When restoring a container from a checkpoint, containerd preserves CDI-related annotations from the checkpoint archive rather than relying solely on the pod's create-time specification. This allows a user with pod creation permissions to bypass standard Kubernetes resource allocation and device plugin enforcement, injecting arbitrary CDI edits (such as device nodes and host mounts) into the restored container. Successful exploitation requires that the node has CDI enabled and contains a matching host CDI specification for the requested device; environments where CDI is disabled or lacking sensitive device specifications are not affected. This issue has been fixed in versions 2.3.2, 2.2.5 and 2.1.9.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiancontainerdsid2.1.9+ds1-5fixed
Debiancontainerdforky2.1.9+ds1-5fixed
Debiancontainerdtrixie1.7.24~ds1-6+deb13u1not affected
Debiancontainerdtrixie-security1.7.24~ds1-6+deb13u1not affected
Debiancontainerdbookworm1.6.20~ds1-1+deb12u3not affected
Debiancontainerdbookworm-security1.6.20~ds1-1+deb12u2not affected
Cpecontainerd-appNot reported2.2.1-0ubuntu1~24.04.3fixed
CpecontainerdNot reported2.2.1-0ubuntu1~24.04.3fixed
CpecontainerdNot reported2.1.9fixed
CpecontainerdNot reported2.2.5fixed
CpecontainerdNot reported2.3.2fixed
Ubuntucontainerd-app22.041.7.2-0ubuntu1~22.04.1vulnerable
Ubuntucontainerd-app22.041.7.12-0ubuntu2~22.04.1vulnerable
Ubuntucontainerd-app22.041.7.24-0ubuntu1~22.04.1vulnerable
Ubuntucontainerd-app22.041.7.24-0ubuntu1~22.04.2vulnerable
Ubuntucontainerd-app22.041.7.27-0ubuntu1~22.04.1vulnerable
Ubuntucontainerd-app22.041.7.28-0ubuntu1~22.04.1vulnerable
Ubuntucontainerd-app22.042.2.1-0ubuntu1~22.04.1vulnerable
Ubuntucontainerd-app22.042.2.1-0ubuntu1~22.04.2fixed
Ubuntucontainerd-app24.041.7.2-0ubuntu2vulnerable
Ubuntucontainerd-app24.041.7.12-0ubuntu1vulnerable
Ubuntucontainerd-app24.041.7.12-0ubuntu2vulnerable
Ubuntucontainerd-app24.041.7.12-0ubuntu3vulnerable
Ubuntucontainerd-app24.041.7.12-0ubuntu4vulnerable
Ubuntucontainerd-app24.041.7.12-0ubuntu4.1vulnerable
Ubuntucontainerd-app24.041.7.19-0ubuntu1~24.04.1vulnerable
Ubuntucontainerd-app24.041.7.19+really1.7.12-0ubuntu4.2vulnerable
Ubuntucontainerd-app24.041.7.24-0ubuntu1~24.04.1vulnerable
Ubuntucontainerd-app24.041.7.24-0ubuntu1~24.04.2vulnerable
Ubuntucontainerd-app24.041.7.27-0ubuntu1~24.04.1vulnerable
Ubuntucontainerd-app24.041.7.28-0ubuntu1~24.04.1vulnerable
Ubuntucontainerd-app24.041.7.28-0ubuntu1~24.04.2vulnerable
Ubuntucontainerd-app24.042.2.1-0ubuntu1~24.04.2vulnerable
Ubuntucontainerd-app24.042.2.1-0ubuntu1~24.04.3fixed
Ubuntucontainerd-app25.102.0.2-0ubuntu2vulnerable
Ubuntucontainerd-app25.102.0.5-0ubuntu1vulnerable
Ubuntucontainerd-app25.102.1.3-0ubuntu2vulnerable
Ubuntucontainerd-app25.102.1.3-0ubuntu3vulnerable
Ubuntucontainerd-app25.102.1.3-0ubuntu3.1vulnerable
Ubuntucontainerd-app25.102.2.1-0ubuntu1~25.10.1vulnerable
Ubuntucontainerd-app25.102.2.1-0ubuntu1~25.10.2fixed
Ubuntucontainerd-stable25.102.1.3-0ubuntu1vulnerable
Ubuntucontainerd-stable25.102.1.6-0ubuntu1~25.10.1vulnerable
Ubuntucontainerd-stable25.102.1.6-0ubuntu1~25.10.2fixed
Ubuntucontainerd-app26.042.1.3-0ubuntu3vulnerable
Ubuntucontainerd-app26.042.2.1-0ubuntu1vulnerable
Ubuntucontainerd-app26.042.2.2-0ubuntu1vulnerable
Ubuntucontainerd-app26.042.2.2-0ubuntu1.1fixed
Ubuntucontainerd-stable26.042.1.3-0ubuntu1vulnerable
Ubuntucontainerd-stable26.042.1.5-0ubuntu1vulnerable
Ubuntucontainerd-stable26.042.2.1-0ubuntu1vulnerable
Ubuntucontainerd-stable26.042.2.2-0ubuntu1vulnerable
Ubuntucontainerd-stable26.042.2.2-0ubuntu1.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiancontainerdsourcesid2.1.9+ds1-1not yet assignedNot reported[1140385]
Debiancontainerdsourceforky2.1.9+ds1-1not yet assignedNot reported[1140385]
DebiancontainerdsourcetrixieNot affectedunimportantNot reported[1140385]
DebiancontainerdsourcebookwormNot affectedunimportantNot reported[1140385]
Cpecontainerd-appcpeNot reported2.2.1-0ubuntu1~24.04.3Not reportedNot reportedNot reported
CpecontainerdcpeNot reported2.2.1-0ubuntu1~24.04.3Not reportedNot reportedNot reported
CpecontainerdcpeNot reported2.1.9Not reportedNot reportedNot reported
CpecontainerdcpeNot reported2.2.5Not reportedNot reportedNot reported
CpecontainerdcpeNot reported2.3.2Not reportedNot reportedNot reported
Ubuntucontainerd-appdeb22.042.2.1-0ubuntu1~22.04.2Not reportedUBUNTU-CVE-2026-53492Not reported
Ubuntucontainerd-appdeb24.042.2.1-0ubuntu1~24.04.3Not reportedUBUNTU-CVE-2026-53492Not reported
Ubuntucontainerd-appdeb25.102.2.1-0ubuntu1~25.10.2Not reportedUBUNTU-CVE-2026-53492Not reported
Ubuntucontainerd-stabledeb25.102.1.6-0ubuntu1~25.10.2Not reportedUBUNTU-CVE-2026-53492Not reported
Ubuntucontainerd-appdeb26.042.2.2-0ubuntu1.1Not reportedUBUNTU-CVE-2026-53492Not reported
Ubuntucontainerd-stabledeb26.042.2.2-0ubuntu1.1Not reportedUBUNTU-CVE-2026-53492Not reported

[Debian bug #1140385]

OpenFactory catalog packages

Vulnerability data is temporarily unavailable.

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]