Podman: quadlet install --replace does not truncate, leaving stale options in the new unit

Impact

On hosts where Quadlet units drive container workloads, replacing a unit file with a shorter one silently leaves trailing bytes of the old file in place, because the destination is opened without O_TRUNC and the io.Copy fallback is taken whenever reflink is unavailable (which includes common RHEL XFS setups). An operator who edits a Quadlet to drop a trailing security option - removing an AddCapability line, tightening a Volume mount - gets a success with no warning while the old line is still honoured. The practical risk on a GPU node is a container that keeps a capability or a host bind mount the operator believes was removed, so later image updates expose host paths into a workload container. There is no information disclosure to a new party: the actor already had write access to the Quadlet.

Who can reach it

Local, authenticated user who already manages Quadlet units on the host, combined with an unlucky filesystem and an edit that shortens the file. Not remotely reachable and not a privilege boundary crossing on its own; the exposure comes from the operator's intended hardening failing to apply.

What to do

Update the podman package from the Red Hat errata (RHSA-2026:69961, RHSA-2026:70201) or an equivalent upstream build and re-run the affected quadlet install --replace operations. No daemon or node restart is needed, but any unit installed with --replace since the last change should be diffed against its source, since a bad file persists after patching; restarting the affected containers is required for a corrected unit to take effect.

References

Related entries

• Kubernetes (kube-apiserver): Admission webhook responses redirect apiserver requests into private networksCVE-2020-8561 · Kubernetes (kube-apiserver)Medium
• Cilium: Deny rules for prefixes broader than /32 can be ignoredCVE-2024-47825 · CiliumMedium
• Cilium: WireGuard encryption gap in a specific Cilium configurationCVE-2025-32793 · CiliumMedium
• Cilium: Egress policies referencing AWS security group IDs are misappliedCVE-2025-64715 · CiliumMedium
• Argo Workflows (Argo Server, --auth-mode=client on Kubernetes >= 1.19): PRIVILEGE ESCALATION TO THE SERVER'S IDENTITYNCVD-2021-015-argo-workflows-argo-server-auth · Argo Workflows (Argo Server, --auth-mode=client on Kubernetes >= 1.19)Low
• netavark: container name resolution falls through to host search domains and reaches external serversCVE-2025-8283 · netavark (Podman/CRI-O container DNS resolution)Low