CVE-2026-24054: Kata Containers Runtime: Host block device can be hotplugged to the VM if the container image is malformed or contains no layers

Vulnerability summary

CVE-2026-24054 is a critical (CVSS 10.0) vulnerability in kata-containers. EPSS estimates a 0.51% chance of exploitation in the next 30 days, higher than 43.8% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 29-01-2026
   PublishedVulnerability first disclosed.
2. 29-01-2026
   Last modifiedVulnerability information updated.

Description

Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines (VMs) that perform like containers. In versions prior to 3.26.0, when a container image is malformed or contains no layers, containerd falls back to bind-mounting an empty snapshotter directory for the container rootfs. When the Kata runtime attempts to mount the container rootfs, the bind mount causes the rootfs to be detected as a block device, leading to the underlying device being hotplugged to the guest. This can cause filesystem-level errors on the host due to double inode allocation, and may lead to the host's block device being mounted as read-only. Version 3.26.0 contains a patch for the issue.

• CWE-754Improper Check for Unusual or Exceptional ConditionsThe product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product.