containerd: CRI ExecSync I/O drain never times out, leaking goroutines until the OOM killer takes the runtime

Impact

An exec probe or lifecycle hook whose command spawns a long-lived background child that keeps the stdout/stderr pipes open leaves containerd's drainExecSyncIO goroutine blocked forever - the drain phase had no timeout and ignored request-context cancellation. Repeated ExecSync calls, which on Kubernetes means every exec-probe interval, accumulate blocked goroutines and host memory until the OOM killer terminates containerd. On a GPU node that takes down the runtime for every pod on the box, and GPU workloads are exactly the ones that are expensive to reschedule: allocations must be re-granted, containers re-pulled, and long training jobs restart from checkpoint. A tenant that controls its own pod spec controls the probe command, so this is reachable without any host privilege. Only Linux deployments using containerd's CRI implementation are affected.

Who can reach it

A tenant able to create a pod with an exec probe or a lifecycle hook on the node - namespace-level Kubernetes access, no host privilege. Also reachable unintentionally by a badly behaved workload.

What to do

Upgrade containerd to 1.7.35, 2.0.12, 2.2.8 or 2.3.5 and restart the containerd daemon on each node. Restarting containerd does not by itself kill running containers, but on most distributions the node should be drained first to avoid probe and stream disruption during the restart. Until patched, audit exec probes and lifecycle hooks for commands that leave background children holding stdio, and watch containerd RSS and goroutine count.

References

Related entries

• Kubernetes (kube-apiserver): A node can delete itself, and cascade-delete other objects, by adding an OwnerReferenceCVE-2025-5187 · Kubernetes (kube-apiserver)Medium
• JFrog Artifactory Helm chart: generated TLS private keys retained in rendered manifestsCVE-2026-66016 · JFrog Artifactory self-hosted Helm deployment (generated TLS private keys)Medium
• Kubernetes (kube-apiserver): Node address not verified when proxyingCVE-2022-3294 · Kubernetes (kube-apiserver)Medium
• Argo CD (Helm OCI repository credential logging): CREDENTIAL DISCLOSURE THROUGH THE LOG PIPELINE: Argo CD wrote theNCVD-2021-016-argo-cd-helm-oci-repository-cred · Argo CD (Helm OCI repository credential logging)Medium
• Helm: Path traversal in `helm fetch --untar` writes outside the target directoryCVE-2019-1000008 · HelmMedium
• Kubernetes (kubectl): `kubectl cp` path traversal from a malicious container tar overwrites files on the operator'sCVE-2019-11246 · Kubernetes (kubectl)Medium