CVE-2025-31133 runc container escape via "masked path" abuse due to mount race conditions
Attackers can escape containers and access host resources by exploiting a race condition in runc's masked path verification.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-31133?
CVE-2025-31133 is a high-severity vulnerability in opencontainers runc, published on 6 Nov 2025. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
runc is a CLI tool for spawning and running containers according to the OCI specification. In versions 1.2.7 and below, 1.3.0-rc.1 through 1.3.1, 1.4.0-rc.1 and 1.4.0-rc.2 files, runc would not perform sufficient verification that the source of the bind-mount (i.e., the container's /dev/null) was actually a real /dev/null inode when using the container's /dev/null to mask. This exposes two methods of attack: an arbitrary mount gadget, leading to host information disclosure, host denial of service, container escape, or a bypassing of maskedPaths. This issue is fixed in versions 1.2.8, 1.3.3 and 1.4.0-rc.3.
Which versions are affected by CVE-2025-31133?
7 open source packages ship an affected version, including github.com/opencontainers/runc. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/opencontainers/runc Go | All versions | 1.2.8, 1.3.3, 1.4.0-rc.3 |
github.com/opencontainers/runc Go | All versions | 1.2.8 |
github.com/opencontainers/runc Go | All versions | 1.2.8 |
github.com/opencontainers/runc Go | From 1.3.0-rc.1 | 1.3.3 |
github.com/opencontainers/runc Go | From 1.3.0-rc.1 | 1.3.3 |
github.com/opencontainers/runc Go | From 1.4.0-rc.1 | 1.4.0-rc.3 |
1 more packages
github.com/opencontainers/runc Go | From 1.4.0-rc.1 | 1.4.0-rc.3 |
Products include Linuxfoundation Runc.
How do I fix CVE-2025-31133?
Upgrade github.com/opencontainers/runc to a fixed version for your release line: 1.2.8, 1.3.3 or 1.4.0-rc.3.
Is CVE-2025-31133 being exploited?
There is no known exploitation of CVE-2025-31133 in the wild and no public exploit code.
Public exploit code: 3 proofs of concept on GitHub.
Other vulnerabilities in opencontainers runc
- CVE-2025-52565 container escape due to /dev/console mount and related races
- CVE-2025-52881 runc: LSM labels can be bypassed with malicious config using dummy procfs files
- CVE-2023-28642 AppArmor bypass with symlinked /proc in runc
- CVE-2023-25809 rootless: `/sys/fs/cgroup` is writable when cgroupns isn't unshared in runc
- CVE-2024-45310 runc can be confused to create empty files/directories on the host
Sources
Also known as AZL-69818, AZL-70547, AZL-70592, BELL-CVE-2025-31133, CLEANSTART-2026-PQ07861, DEBIAN-CVE-2025-31133 and 24 more.