CVE-2026-123876: Podman: containers-common: containers-common: default seccomp af_vsock/netlink_audit deny rules bypassable via 32-bit truncation

Published Nov 6, 2026

Updated

A flaw was found in the default seccomp profile used by Podman via containers-common. Deny rules for AFVSOCK and NETLINKAUDIT compared socket arguments with unmasked 64-bit equality. Because the kernel truncates those int arguments to 32 bits, setting upper bits can bypass the deny rules.

Event History

Nov 6, 2026

CVE Published

via MITRE·05:38 PM

Data Sourced

via MITRE·05:38 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What configurations are affected?

The issue affects workloads using Podman’s default seccomp profile supplied through containers-common. The vulnerable rules are the profile’s denials for AF_VSOCK and NETLINK_AUDIT socket arguments.

What does an attacker need to bypass the restrictions?

An attacker needs the ability to invoke the relevant socket operations from within a container governed by the affected default profile. They can set upper 32 bits in the socket argument values so that the kernel’s 32-bit truncation produces AF_VSOCK or NETLINK_AUDIT while the profile’s unmasked 64-bit equality check does not match.

CVE-2026-123876: Podman: containers-common: containers-common: default seccomp af_vsock/netlink_audit deny rules bypassable via 32-bit truncation

Event History

Frequently Asked Questions

What configurations are affected?

What does an attacker need to bypass the restrictions?

Company

Resources

Contact

Frequently Asked Questions

What configurations are affected?

What does an attacker need to bypass the restrictions?