CVE-2026-41579 runc: Malicious image with /dev symlink can trigger limited host filesystem integrity violations

What is CVE-2026-41579?

CVE-2026-41579 is a low-severity path traversal vulnerability in opencontainers runc, published on 1 Jul 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

runc is a CLI tool for spawning and running containers according to the OCI specification. In versions prior to 1.3.6, 1.4.0-rc.1, 1.4.0-rc.12, 1.5.0-rc.1, and 1.5.0-rc.1, when setting up the container rootfs, setupPtmx and setupDevSymlinks call os.Remove and os.Symlink with a filepath.Join string which allow an image with /dev as a symlink to trick runc into deleting files called ptmx on the host or creating a hardcoded set of symlinks with specific names and targets in an arbitrary pre-existing host directory. This issue is not exploitable under Docker, because Docker creates a top-level read-only layer that masks any malicious /dev symlink present in the container image — unlike some other Linux container tooling, whose higher-level runtimes built on runc remain exposed to exploitation via a malicious image. This issue has been fixed in versions 1.3.6, 1.4.3 and 1.5.0.

Weakness: CWE-61

Which versions are affected by CVE-2026-41579?

7 open source packages ship an affected version, including github.com/opencontainers/runc. It affects 1 product.

Products include Linuxfoundation Runc.

How do I fix CVE-2026-41579?

Upgrade github.com/opencontainers/runc to a fixed version for your release line: 1.3.6, 1.4.3 or 1.5.0-rc.3.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2026-41579 being exploited?

There is no known exploitation of CVE-2026-41579 in the wild and no public exploit code.

Other vulnerabilities in opencontainers runc

• CVE-2025-52565 container escape due to /dev/console mount and related races High 8.4
• CVE-2025-31133 runc container escape via "masked path" abuse due to mount race conditions High 7.3
• CVE-2025-52881 runc: LSM labels can be bypassed with malicious config using dummy procfs files High 7.3
• CVE-2023-28642 AppArmor bypass with symlinked /proc in runc Medium 6.1
• CVE-2023-25809 rootless: `/sys/fs/cgroup` is writable when cgroupns isn't unshared in runc Medium 5.0

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as AZL-91590, BELL-CVE-2026-41579, CLEANSTART-2026-GY71678, CLEANSTART-2026-RD37922, CLSA-2026-1783518302, CLSA-2026-1784034091 and 42 more.