Database/Container, Kubernetes & orchestration

BuildKit: a build definition resolving the same Git ref twice panics the daemon and kills in-flight builds

CVSS 6.7CVE-2026-121522Container, Kubernetes & orchestrationcurated

Impact

BuildKit is what builds the container images a GPU fleet runs - CUDA base images, training and serving images - usually as a shared daemon or a buildkitd pod in CI. A build definition that resolves metadata for the same Git source reference twice crashes the daemon, taking down every build that daemon was handling, not just the offending one. On shared build infrastructure that means one tenant or one repository can stall the image pipeline for everyone, and a crash loop blocks the path by which operators ship patched images. Availability only - the advisory describes a panic, not memory disclosure or code execution.

Who can reach it

Anyone who can submit a build definition to the daemon - a CI job, a developer with buildx access, or a repository whose Dockerfile/frontend is built automatically. Local vector per the CVSS, with user interaction in the form of a build being run.

What to do

Upgrade BuildKit to v0.34.2, which contains the fix; affected range is v0.26.0 through v0.34.1. Restart buildkitd (or roll the builder pods) after upgrading - in-flight builds are lost either way, and no node drain or reboot is involved.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-121522 https://github.com/moby/buildkit/security/advisories/GHSA-2fqp-xg6f-v7gj

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.