CRI-O: an image env entry with no '=' panics the crio daemon and takes down the node's runtime

Impact

A CreateContainer request that leaves the CRI Envs field nil makes CRI-O fall back to the image's own config.Env without the key=value validation the normal merge path applies. An image carrying a bare entry such as NOEQUALS causes an index-out-of-range panic in the crio process, which is unrecovered: the container runtime dies for the whole node, not just for the offending workload. On a GPU node that means every tenant's pods lose their runtime at once and no new containers start until crio is back, and long-running training jobs holding GPU memory are the ones that pay for the restart. The trigger travels inside an ordinary OCI image, so it does not require touching the node itself - only the ability to get a chosen image scheduled there.

Who can reach it

A local, authenticated actor with high privileges on the node's CRI path - in practice anyone who can cause a container to be created from an image they control (a tenant with pod-create rights pointing at their own registry image). No network access to the node is needed.

What to do

The record does not name a fixed CRI-O version; track Red Hat's CVE page and the linked Bugzilla for the build that adds the key=value validation to the nil-Envs fallback. Until then, the practical mitigation is admission control on which registries and images may run, since the payload is an image config field. Applying the fix means updating the crio package and restarting the runtime, which restarts every container on the node - on OpenShift the Machine Config Operator rolls this out node by node, so plan a drain per GPU node rather than a live upgrade.

References

Related entries

• Calico: install-cni logs the rendered CNI config including the substituted service-account tokenCVE-2026-41184 · CalicoMedium
• Calico: Azure IPAM helper logs the mutated CNI config including credentialsCVE-2026-41185 · CalicoMedium
• Calico: kube-controllers and Goldmane bind an unauthenticated pprof listener to 0.0.0.0CVE-2026-41186 · CalicoMedium
• Firecracker: Network stack freezes under heavy ingressCVE-2020-16843 · FirecrackerMedium
• ingress-nginx: A tenant can overwrite another ingress's basic-auth password fileCVE-2020-8553 · ingress-nginxMedium
• Podman: Rootless containers see all traffic as coming from 127.0.0.1, defeating localhost-trust checksCVE-2021-20199 · PodmanMedium