CVE-2026-41579: runc /dev Symlink Vulnerability – Docker Protected, Podman & Containerd at Risk

Technical summary

The vulnerability exists in runc's setupPtmx and setupDevSymlinks functions, which use filepath.Join to construct paths for device setup without proper validation. When an attacker-controlled container image contains /dev as a symlink pointing outside the container, os.Remove and os.Symlink operations are performed on attacker-influenced paths. This allows two attack vectors: deletion of a file named 'ptmx' on the host, or creation of hardcoded symlinks with predetermined names and targets in any pre-existing host directory accessible to the container process. The root cause is path traversal resulting from insufficient canonicalization of symlinks before filesystem operations. This is categorized as CWE-61 (Symlink Following).

Business impact

Organizations using runc-based container orchestration outside of Docker face risk of host filesystem tampering from untrusted or supply-chain-compromised container images. A successful exploit could modify host system configurations, alter critical symlinks, or delete host files that the container runtime has permissions to access. While the CVSS score is low, the impact depends heavily on deployment context—organizations running containers from untrusted registries or with insufficient image scanning controls face elevated risk. Docker deployments are not vulnerable due to Docker's architectural protections.

Affected systems

runc versions prior to 1.3.6, 1.4.3, and 1.5.0 are affected. The vulnerability impacts runc users on Linux systems. Container platforms and tools that directly use runc and do not implement Docker-style read-only masking layers (such as Podman, containerd configurations without the protective layer, and other runc-based runtimes) are susceptible. Docker Engine is not affected due to its layering architecture.

Exploitability

Exploitability requires control over a container image deployed to a system running vulnerable runc versions. The attack is not network-remote; an attacker must either supply a malicious image or compromise an image in a registry. Successful exploitation requires that the container runtime has write permissions to the target host directory. User interaction is minimal once a malicious image is pulled and executed. The vulnerability is technically exploitable but operationally constrained by image source control and runtime permissions. CVSS vector AV:L/AC:L/PR:N/UI:R reflects local attack vector requiring user interaction to run the container.

Remediation

Update runc to version 1.3.6 or later (1.4.3 for the 1.4.x branch, or 1.5.0 for the 1.5.x branch). For Docker users, no action is strictly necessary due to Docker's protective architecture, but staying current is a best practice. For other runc-based container runtimes (Podman, containerd, CRI-O), prioritize updates. Operationally, implement image scanning and source validation to reduce the risk of deploying malicious images, even before patching.

Patch guidance

Verify the current runc version in your deployment with 'runc version' or through your container runtime's version commands. For container orchestration platforms: update the underlying runc binary or use a patched container runtime distribution. Docker Desktop users should update to the latest version, which includes patched runc. Podman users should update via their OS package manager or download patched releases. Containerd should be updated to a version that bundles runc 1.3.6, 1.4.3, or 1.5.0 or later. Test patches in a non-production environment to ensure compatibility with your workloads.

Detection guidance

Monitor for attempts to pull or run container images that contain /dev as a symlink. Image scanning tools (Trivy, Grype, Anchore) should flag images with symlinks in /dev as suspicious. Runtime behavior monitoring can detect unusual symlink creation or file deletion patterns during container setup, particularly targeting ptmx. Audit logs for runc or container runtime initialization failures may indicate exploitation attempts. Review container image provenance and registry sources—restrict pulls to trusted, scanned registries.

Why prioritize this

This vulnerability carries low CVSS severity (3.3) and does not affect the most widely deployed container platform (Docker). However, organizations using alternative runc-based runtimes without Docker's protections should prioritize patching to prevent subtle host filesystem tampering from malicious images. The vulnerability is not in CISA's KEV catalog, indicating limited active exploitation in the wild. Prioritize based on deployment: Docker users can deprioritize; Podman, containerd, and other runc direct users should patch promptly.

Risk score, explained

The CVSS 3.1 score of 3.3 (LOW) reflects: local attack vector (AV:L) because exploitation requires container execution on a target system, low attack complexity (AC:L) because a malicious image can be prepared offline, no privileges required (PR:N) to exploit once a container process is spawned, user interaction (UI:R) in the form of running the container, unchanged scope (S:U), no confidentiality impact (C:N), limited integrity impact (I:L) via file/symlink manipulation, and no availability impact (A:N). The low severity is appropriate for a local, image-based attack that Docker deployment mitigates entirely. Risk elevation in your environment depends on use of non-Docker runc deployments and image source controls.

Frequently asked questions