containers/storage: leaked file descriptor on corrupt layers can exhaust a container runtime's fd limit

Impact

ApplyLayer and ApplyUncompressedLayer in containers/storage leak a file descriptor when handed a corrupt or malicious layer tarball. Repeated unbounded calls exhaust the process's file descriptor limit, which for Podman, Buildah, CRI-O or any image-pull path built on this library means the component stops being able to open files - no further image pulls or container starts on that node until it is restarted. On a GPU node this is a self-inflicted-by-pull denial of service rather than a path to code execution or data access: an operator sees pods stuck in image-pull or container-create on one node. The record scores it 3.3, local, availability-only, and needing user interaction, i.e. somebody has to pull or apply the hostile image.

Who can reach it

Local, via whatever can cause layers to be applied on the node - a user or workload that can trigger an image pull or layer unpack of an image they control. Needs the hostile layer to be pulled repeatedly to reach fd exhaustion; no authentication to the library itself.

What to do

Update the containers/storage-derived packages on affected hosts and in affected container images and restart the runtime that embeds them (Podman/Buildah/CRI-O); Red Hat tracks the per-product fixed versions at access.redhat.com/security/cve/CVE-2026-114236 - this record names no version. Ordinary runtime patching and daemon restart, not a node drain. Restricting which registries nodes may pull from limits who can feed in corrupt layers in the meantime. Note the Red Hat product list includes NVIDIA-adjacent components (DPU kit for NVIDIA, JetPack 6 for RHEL) only because they ship the library downstream; the flaw is in containers/storage.

References

Related entries

• runc: setupPtmx/setupDev rootfs setup flaw during container rootfs constructionCVE-2026-41579 · runcLow
• Talos Linux: talosctl support bundles include unredacted private registry credentialsCVE-2026-77564 · Talos Linux talosctl support bundle (registryconfigs and etcfilespecs resources)Low
• Kubernetes: Endpoint/EndpointSlice confused-deputy lets users reach networks they should notCVE-2021-25740 · KubernetesLow
• cosign / sigstore: Attacker-controlled registry returns unbounded attestations, DoSing the verifierCVE-2023-46737 · cosign / sigstoreLow
• Kubernetes (kube-apiserver): NetworkPolicy is not applied during a race in namespace termination, so pods briefly runCVE-2024-7598 · Kubernetes (kube-apiserver)Low
• ingress-nginx: auth-url protection bypassCVE-2026-24513 · ingress-nginxLow