Bug 2520330 (CVE-2026-76061)

Summary: CVE-2026-76061 cri-o: CRI-O: bind_mount_prefix intermediate-symlink prefix bypass
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: akhatavk, aos-team-art-private, asdas, dpaolell, jdelft, jupierce, lgarciaa, mbiarnes, ppalepu, ppostler, prdhamdh, security-response-team, sghai, sidsharm, suppawar, vlaad
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in CRI-O's `bind_mount_prefix` handling. When configured with a non-empty `bind_mount_prefix`, a malicious container or local attacker could use a Container Runtime Interface (CRI) hostPath containing an intermediate absolute symlink. This could cause the bind mount source to resolve outside the intended prefixed root, potentially leading to unauthorized access to files or privilege escalation on the host system.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2546669, 2546670, 2546671, 2546676, 2546677, 2546679, 2546680, 2546682    
Bug Blocks:    

Description OSIDB Bzimport 2026-08-20 14:01:06 UTC 
A security issue was found in CRI-O’s bind_mount_prefix handling where it is configured with non-empty bind_mount_prefix, a CRI hostPath containing an intermediate absolute symlink may cause the eventual bind mount source to resolve outside the inteneded prefixed root. bind_mount_prefix is used in deployments where CRI-O itself runs in a container and the real host root is mounted under a prefix such as /host. In this If kubernetes/CRI requests CRI-O to mount /var/lib/example it will mount /host/var/lib/example. The exploitation requires that the resulting path contains an intermediate absolute symlink.