runc: Container filesystem breakout via directory traversal in mount handling

Impact

Container filesystem breakout via directory traversal in mount handling; host root

Who can reach it

Any tenant workload able to create multiple pods with specific mount config

What to do

Replace runc binary; drain node

References

Related entries

• runc: Insufficient checks when bind-mounting /dev/console allow writes to arbitrary host procfs pathsCVE-2025-52565 · runcHigh
• runc: AppArmor restriction bypass via mount-target check flawCVE-2019-16884 · runcHigh
• runc: Insufficient verification of masked-path bind mounts (/dev/null replaced by symlink) enables containerCVE-2025-31133 · runcHigh
• runc: Attacker misdirects runc writes to /proc via racing symlinksCVE-2025-52881 · runcHigh
• runc: Volume-mount race gives incorrect access control and privilege escalation to hostCVE-2019-19921 · runcHigh
• runc: Regression of CVE-2019-19921: incorrect access control leading to privilege escalation via volume mountsCVE-2023-27561 · runcHigh