VulnSocial

CVE-2026-41579General(linuxfoundation / runc)

LOWCVSS 3.3 · LOW

Signal is active with 2 mentions in latest observed window

Immediate actions

  • Patch linuxfoundation runc systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

runc is a CLI tool for spawning and running containers according to the OCI specification. In versions prior to 1.3.6, 1.4.0-rc.1, 1.4.0-rc.12, 1.5.0-rc.1, and 1.5.0-rc.1, when setting up the container rootfs, setupPtmx and setupDevSymlinks call os.Remove and os.Symlink with a filepath.Join string which allow an image with /dev as a symlink to trick runc into deleting files called ptmx on the host or creating a hardcoded set of symlinks with specific names and targets in an arbitrary pre-existing host directory. This issue is not exploitable under Docker, because Docker creates a top-level read-only layer that masks any malicious /dev symlink present in the container image — unlike some other Linux container tooling, whose higher-level runtimes built on runc remain exposed to exploitation via a malicious image. This issue has been fixed in versions 1.3.6, 1.4.3 and 1.5.0.

linuxfoundation CVEsBack to dashboard
0.5/ 10 priority

Sources & remediation

Patch / fix
Weakness type (CWE)
CWE-61

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • runc

Threat summary

  • Patch or workaround signal is available
  • 7 mentions across 4 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 3 signals
  • Technical details provided in 3 signals
  • General: 4 classified signals
  • Peaked 2d ago at 2 mentions (2026-06-14); latest day: 2
  • 7 total mentions across 4 days

Affected systems

Vendors
linuxfoundation
Products
runc

1 version affected across 1 product

Deep dive

Activity timeline7 mentions / 4d
01122Mentions · 2026-06-13: 1Mentions · 2026-06-14: 2Mentions · 2026-06-18: 2Mentions · 2026-07-02: 2Patch / Workaround · 2026-06-14: 1Patch / Workaround · 2026-06-18: 2Technical Details · 2026-06-14: 1Technical Details · 2026-06-18: 206-1306-1406-1807-02
Signal classification2 categories
General
457.1%
Patch
342.9%
Referenced assets3 URLs
Classification over time
DateTotalLabels
2026-06-131
General1
2026-06-142
General1Patch1
2026-06-182
Patch2
2026-07-022
General2
Full discourse7 posts
  • Aleksa Sarai 暗号君@lordcyphar
    General

    I haven't said this publicly before, but back in April runc was scanned by Mythos and it didn't find anything (apparently it was the first project where this was the case). Funnily enough this means it missed CVE-2026-41579 despite it being similar to previous (very recent) bugs.

    Post summary

    The post notes that Mythos scanning missed CVE-2026-41579 on runc, with no additional vulnerability details, PoC, exploit or patch information.

    100112708
    1.2K followersView on X
  • Aleksa Sarai 暗号君@lordcyphar
    General

    I don't think this is because we have perfect software, I think that runc is just such an atypical Go project that LLMs struggle to "understand" it. CVE-2026-41579 was missed by me because I assumed some functions were called in a different security context, very unusual for Go.

    Post summary

    The text briefly references CVE-2026-41579 but provides no actionable details such as PoC, exploit, patch, or evidence of exploitation.

    10010116
    1.2K followersView on X
  • Open Source Security mailing list@oss_security
    Patch

    CVE-2026-41579: runc allows a malicious image with a /dev symlink to trigger limited host filesystem integrity violations https://www.openwall.com/lists/oss-security/2026/06/13/2 Fixed in runc 1.3.6, 1.4.3, 1.5.0-rc.3

    Post summary

    CVE-2026-41579 exposes a host filesystem integrity issue via a malicious image; a patch has been released in runc 1.3.6, 1.4.3, and 1.5.0-rc.3.

    00020279
    4.7K followersView on X
  • Vulmon Vulnerability Feed@VulmonFeeds
    General

    CVE-2026-47766 CVE-2026-41579 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-47766

    Post summary

    The content merely lists two CVE identifiers and a link to a vulnerability database, offering no further technical or operational details.

    0001053
    4.0K followersView on X
  • Can Artuc@canartuc
    Patch

    runc 1.3.6 backports a fix for CVE-2026-41579, a /dev symlink flaw that handed a malicious container image limited host filesystem write access. If you run containers, this is a patch-now release. How fast does a runc CVE move through your update pipeline?

    Post summary

    The post announces that runc 1.3.6 includes a patch for CVE-2026-41579, a /dev symlink flaw granting limited host filesystem write access to malicious container images, and urges immediate updating.

    0000037
    171 followersView on X
  • Can Artuc@canartuc
    Patch

    runc shipped 1.4.3, 1.3.6, and 1.5.0-rc.3 on June 13, all fixing CVE-2026-41579: a container image with a /dev symlink could get limited write access to the host filesystem. Low severity, but it sits in rootfs setup. How fast do low-sev runtime CVEs move through your pipeline?

    Post summary

    The post announces that runc has released versions 1.4.3, 1.3.6, and 1.5.0‑rc.3 to patch CVE‑2026‑41579, a low‑severity vulnerability allowing limited host filesystem writes via a container image symlink.

    0000050
    172 followersView on X
  • Vulmon Vulnerability Feed@VulmonFeeds
    General

    CVE-2026-41579 CVE-2026-41579 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-41579

    Post summary

    The content merely repeats the CVE identifier and provides a link, without revealing any technical or operational specifics.

    0000049
    4.0K followersView on X
CPE platform detail3 entries

3 of 3 entries

PartVendorProductVersionTarget SWTarget HW
Applinuxfoundationrunc---
Applinuxfoundationrunc1.5.0--
Applinuxfoundationrunc1.5.0--

Explore more

Back to dashboardlinuxfoundation CVEsrunc vulnerabilities