Bug 2533830

Summary:	CVE-2026-88264 crun: crun: /dev/console symlink follow allows root-owned file creation outside the rootfs [fedora-all]
Product:	[Fedora] Fedora	Reporter:	Ganesh <gnaik>
Component:	crun	Assignee:	Giuseppe Scrivano <gscrivan>
Status:	NEW ---	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	medium	Docs Contact:
Priority:	medium
Version:	rawhide	CC:	gscrivan, lsm5, nicola.sella, pehunt, pholzing
Target Milestone:	---	Keywords:	Security, SecurityTracking
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:	{"flaws": ["57e9b14c-9983-40d0-9df5-3d36c5769dd1"]}
Fixed In Version:		Doc Type:	---
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	2531223

Description Ganesh 2026-09-15 14:13:09 UTC

Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

A flaw was found in crun. During terminal setup, when the OCI configuration does not mount /dev, crun unlinks and recreates /dev/console without preventing symlink follows. A malicious image can make /dev/console a symlink so that crun creates a root-owned file outside the container rootfs. Affected versions are crun 1.29.1 and earlier. This is not CVE-2026-47766, which addressed following a rootfs /dev directory symlink and was fixed in crun 1.28. No fixed release is published yet.