3.3

CVE-2026-41579: linuxfoundation runc UNIX Symbolic Link (Symlink) Following

CVSS: 3.3v3.1LowAnalyzed
AliasesSUSE-SU-2026:23047-1SUSE-SU-2026:23164-1SUSE-SU-2026:3428-2
Published 01-07-2026Last modified 01-07-2026
Open JSON

Vulnerability summary

CVE-2026-41579 is a low (CVSS 3.3) UNIX Symbolic Link (Symlink) Following vulnerability in linuxfoundation runc. EPSS estimates a 0.19% chance of exploitation in the next 30 days, higher than 7.6% of scored vulnerabilities.

Overall risk
13/100
0100
Low · default modelHow is this calculated?
CVSS score
3.3/10
010
Low · v3.1 (CVE.org)
EPSS score
0.19%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 6 · Related 7
OPENSUSE-SU-2026:21431-1OPENSUSE-SU-2026:21483-1SUSE-SU-2026:22938-1SUSE-SU-2026:22942-1SUSE-SU-2026:3428-1SUSE-SU-2026:3433-1

Timeline

  1. 01-07-2026
    PublishedVulnerability first disclosed.
  2. 01-07-2026
    Last modifiedVulnerability information updated.

Description

runc is a CLI tool for spawning and running containers according to the OCI specification. In versions prior to 1.3.6, 1.4.0-rc.1, 1.4.0-rc.12, 1.5.0-rc.1, and 1.5.0-rc.1, when setting up the container rootfs, setupPtmx and setupDevSymlinks call os.Remove and os.Symlink with a filepath.Join string which allow an image with /dev as a symlink to trick runc into deleting files called ptmx on the host or creating a hardcoded set of symlinks with specific names and targets in an arbitrary pre-existing host directory. This issue is not exploitable under Docker, because Docker creates a top-level read-only layer that masks any malicious /dev symlink present in the container image — unlike some other Linux container tooling, whose higher-level runtimes built on runc remain exposed to exploitation via a malicious image. This issue has been fixed in versions 1.3.6, 1.4.3 and 1.5.0.

CVSS metrics

8 scores · 7 sources · 2 versions

EPSS trend

Probability

0.19%

Chance of exploitation in the next 30 days

Percentile

8%

Versus all other CVEs

30-day change

0.00 pp

From 0.19% on 18-09-2026

18-09-202618-10-2026
EPSS score
0.19%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Chainguard107 products
  • buildah< 1.44.0-r6
  • buildah-fips< 1.44.0-r3
  • cadvisor< 0.60.2-r1
  • cadvisor-compat< 0.60.5-r8
  • cadvisor-fips< 0.60.2-r1
Wolfi22 products
  • buildah< 1.44.0-r6
  • cadvisor< 0.60.2-r1
  • cadvisor-compat< 0.60.5-r8
  • ctopAll versions (No fix recorded)
  • docker-machine-driver-harvester< 1.1.0-r1
Suse13 products
  • runc&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS< 1.3.6-150000.101.1
  • runc&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS< 1.3.6-150000.101.1
  • runc&distro=SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS< 1.3.6-150000.101.1
  • runc&distro=SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS< 1.3.6-150000.101.1
  • runc&distro=SUSE Linux Enterprise Server 12 SP5-LTSS< 1.3.6-16.76.1
Ubuntu3 products
  • runcAll versions (No fix recorded)
  • runc-appAll versions (No fix recorded)
  • runc-stableAll versions (No fix recorded)
Debian1 product
  • runcAll versions (No fix recorded) | < 1.3.6+ds1-1
Github.com/opencontainers1 product
  • runc< 1.3.6 | ≥ 1.4.0, < 1.4.3 | ≥ 1.5.0-rc.1, < 1.5.0-rc.3
Linuxfoundation1 product
  • runc< 1.3.6 | ≥ 1.4.0, < 1.4.3 | 1.5.0:rc1 | 1.5.0:rc2
Opencontainers1 product
  • runc< 1.3.6 | ≥ 1.4.0-rc.1, < 1.4.3 | ≥ 1.5.0-rc.1, < 1.5.0-rc.3
Opensuse1 product
  • runc&distro=openSUSE Tumbleweed< 1.4.3-1.1

9 vendors · 150 products

References

15 links
Show all 15 references