ALPINE-CVE-2026-123876: Medium severity alpine/podman vulnerability

Q: Who is exposed to this issue?

Podman deployments using the default seccomp profile supplied through containers-common are exposed. Exploitation requires a local attacker with existing low-privilege access in the affected environment.

Q: What does an attacker need to do to bypass the affected rules?

The attacker must create socket-related syscall arguments for AF_VSOCK or NETLINK_AUDIT with upper 32-bit values set. The kernel truncates these integer arguments to 32 bits, allowing the unmasked 64-bit seccomp comparisons to miss the deny rules.

Q: Are custom seccomp profiles affected?

The issue is described in the default seccomp profile used by Podman through containers-common. The provided data does not establish whether separately maintained custom profiles contain the same unmasked 64-bit comparisons.

Published Nov 6, 2026

Updated

A flaw was found in the default seccomp profile used by Podman via containers-common. Deny rules for AFVSOCK and NETLINKAUDIT compared socket arguments with unmasked 64-bit equality. Because the kernel truncates those int arguments to 32 bits, setting upper bits can bypass the deny rules.

Affected Software

1 affected componentFixes available

alpine/podman<5.8.10-r0

5.8.10-r0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade alpine/podman to a version that resolves this vulnerability.
Fixed in 5.8.10-r0

Event History

Nov 6, 2026

CVE Published

via OSV·06:18 PM

Data Sourced

via OSV·06:18 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Who is exposed to this issue?

Podman deployments using the default seccomp profile supplied through containers-common are exposed. Exploitation requires a local attacker with existing low-privilege access in the affected environment.

What does an attacker need to do to bypass the affected rules?

The attacker must create socket-related syscall arguments for AF_VSOCK or NETLINK_AUDIT with upper 32-bit values set. The kernel truncates these integer arguments to 32 bits, allowing the unmasked 64-bit seccomp comparisons to miss the deny rules.

Are custom seccomp profiles affected?

The issue is described in the default seccomp profile used by Podman through containers-common. The provided data does not establish whether separately maintained custom profiles contain the same unmasked 64-bit comparisons.

ALPINE-CVE-2026-123876: Medium severity alpine/podman vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to do to bypass the affected rules?

Are custom seccomp profiles affected?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to do to bypass the affected rules?

Are custom seccomp profiles affected?