7.8

CVE-2025-31133: runc container escape via "masked path" abuse due to mount race conditions

Analyzed
AliasesUBUNTU-CVE-2025-31133DEBIAN-CVE-2025-31133CGA-2662-qv7j-89xc
Published 06-11-2025Last modified 06-11-2025

Vulnerability summary

CVE-2025-31133 is a high (CVSS 7.8) UNIX Symbolic Link (Symlink) Following vulnerability in linuxfoundation runc. EPSS estimates a 1.24% chance of exploitation in the next 30 days, higher than 69.3% of scored vulnerabilities.

Priority
Routine

Not severe (CVSS 7.3, local access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?
CVSS score
7.8/10
010
High · v3.1 (NVD)
EPSS score
1.24%
0%100%
Low · +0.40 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 52 · Related 45
MGASA-2025-0271OPENSUSE-SU-2025:15705-1OPENSUSE-SU-2025:20072-1OPENSUSE-SU-2026:10073-1OPENSUSE-SU-2026:20072-1OPENSUSE-SU-2026:20080-1

Timeline

  1. 06-11-2025
    PublishedVulnerability first disclosed.
  2. 06-11-2025
    Last modifiedVulnerability information updated.

Description

runc is a CLI tool for spawning and running containers according to the OCI specification. In versions 1.2.7 and below, 1.3.0-rc.1 through 1.3.1, 1.4.0-rc.1 and 1.4.0-rc.2 files, runc would not perform sufficient verification that the source of the bind-mount (i.e., the container's /dev/null) was actually a real /dev/null inode when using the container's /dev/null to mask. This exposes two methods of attack: an arbitrary mount gadget, leading to host information disclosure, host denial of service, container escape, or a bypassing of maskedPaths. This issue is fixed in versions 1.2.8, 1.3.3 and 1.4.0-rc.3.

CVSS metrics

10 scores · 8 sources · 2 versions

EPSS trend

Probability

1.24%

Chance of exploitation in the next 30 days

Percentile

69%

Versus all other CVEs

30-day change

Increase +0.40 pp

From 0.84% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: local access, low-privilege account, user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard120 products
  • azure-vnet-cni< 1.7.4-r2
  • buildah< 1.42.0-r1
  • cluster-autoscaler-1.31< 1.31.5-r4 | < 1.31.5-r1
  • cluster-autoscaler-fips-1.31< 1.31.5-r1 | < 1.31.5-r5
  • ctopAll versions (No fix recorded)
Wolfi21 products
  • buildah< 1.42.0-r1
  • ctopAll versions (No fix recorded)
  • docker-machine-driver-harvesterAll versions (No fix recorded)
  • falco-no-driver< 0.43.0-r0
  • grafana-alloy< 1.11.3-r1
Ubuntu3 products
  • runcAll versions (No fix recorded)
  • runc-appAll versions (No fix recorded) | < 1.3.3-0ubuntu1~22.04.2 | < 1.3.3-0ubuntu1~24.04.2 | < 1.3.3-0ubuntu1~25.10.2
  • runc-stable< 1.3.3-0ubuntu1~25.10.2
Alpine1 product
  • runc≥ 1.3.0, < 1.3.3-r0
Debian1 product
  • runcAll versions (No fix recorded) | < 1.3.3+ds1-2
Github.com/opencontainers1 product
  • runc< 1.2.8 | ≥ 1.3.0-rc.1, < 1.3.3 | ≥ 1.4.0-rc.1, < 1.4.0-rc.3
Linuxfoundation1 product
  • runc< 1.2.8 | ≥ 1.3.0, < 1.3.3 | 1.4.0:rc1 | 1.4.0:rc2
Opencontainers1 product
  • runc< 1.2.8 | ≥ 1.3.0-rc.1, < 1.3.3 | ≥ 1.4.0-rc.1, ≤ 1.4.0-rc.3

8 vendors · 149 products

References

13 links
Show all 13 references