CVE-2026-84042: Crun: crun: rootful krun with passt executes container payload as host root
A flaw was found in crun. When crun is built with libkrun and a container is started rootful with passt networking (krun.usepasst), crun can execute attacker-controlled payload from the container image with host root privileges. The issue is a regression in crun 1.29. It affects crun >= 1.29
Other sources
A flaw was found in crun. When crun is built with libkrun and a container is started rootful with passt networking (krun.usepasst), crun can execute attacker-controlled payload from the container image with host root privileges. The issue is a regression in crun 1.29. It affects crun 1.29 and 1.29.1. A patch is available upstream; no fixed release is published yet.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
Affected deployments use crun 1.29 or 1.29.1 built with libkrun, start containers rootful, and enable passt networking through krun.use_passt.
What does an attacker need to exploit this issue?
The attacker needs their payload to be present in a container image that is run under the affected configuration. The payload can then be executed with host root privileges.
How can I assess whether my environment is vulnerable?
Check whether crun is version 1.29 or 1.29.1, whether it was built with libkrun, and whether rootful containers are launched with krun.use_passt enabled.
What should be done if a fixed release is not available?
An upstream patch is available, but no fixed release has been published. Until a fixed release is available, avoid the affected combination of rootful execution, libkrun, and krun.use_passt.