runc: runc can be tricked into creating empty files/directories at arbitrary host locations

Impact

runc can be tricked into creating empty files/directories at arbitrary host locations

Who can reach it

Any tenant workload with control over the pod's mount config

What to do

Replace runc binary; drain node

References

Related entries

• runc: setupPtmx/setupDev rootfs setup flaw during container rootfs constructionCVE-2026-41579 · runcLow
• runc: Host runc binary overwritten from inside a containerCVE-2019-5736 · runcHigh
• runc: "Leaky Vessels": internal file descriptor leak lets a container process start with cwd in the host filesystemCVE-2024-21626 · runcHigh
• runc: Container filesystem breakout via directory traversal in mount handlingCVE-2021-30465 · runcHigh
• runc: Insufficient checks when bind-mounting /dev/console allow writes to arbitrary host procfs pathsCVE-2025-52565 · runcHigh
• runc: AppArmor restriction bypass via mount-target check flawCVE-2019-16884 · runcHigh