Database/Container, Kubernetes & orchestration

BuildKit: special file inodes where regular files are expected give host device access on rootful workers

CVSS 6.0CVE-2026-93320Container, Kubernetes & orchestrationcurated

Impact

BuildKit can be tricked into performing file operations against special inodes - device nodes, FIFOs and similar - in places where it expects a regular file. On a rootful worker that can mean unintended access to host device files from inside a build, which is an integrity break on the build host rather than just a failed build; on other configurations the effect is operations that block or hang. Operators who run buildkitd rootful on a shared builder - common because rootless mode complicates GPU and overlay setups - should treat this as a build-to-host boundary issue. The CVSS vector records high integrity and availability impact to the subsequent system with user interaction required.

Who can reach it

A caller who can supply the build context or Dockerfile consumed by a rootful buildkitd worker. CVSS is AV:L/PR:N/UI:A - no authentication to the daemon beyond build submission, but it needs an operator or pipeline to run the crafted build.

What to do

Upgrade BuildKit to v0.33.1 and restart buildkitd. Where the shared builder handles untrusted contexts, move it to a rootless worker or an isolated, disposable build node; that is a rebuild of the builder rather than a daemon restart. No firmware or kernel work involved.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-93320 https://github.com/moby/buildkit/releases/tag/v0.33.1 https://github.com/moby/buildkit/security/advisories/GHSA-9728-qjrv-2xh2

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.