CVE-2026-84042: Crun: crun: rootful krun with passt executes container payload as host root
A flaw was found in crun. When crun is built with libkrun and a container is started rootful with passt networking (krun.usepasst), crun can execute attacker-controlled payload from the container image with host root privileges. The issue is a regression in crun 1.29. It affects crun >= 1.29
Other sources
A flaw was found in crun. When crun is built with libkrun and a container is started rootful with passt networking (krun.usepasst), crun can execute attacker-controlled payload from the container image with host root privileges. The issue is a regression in crun 1.29. It affects crun 1.29 and 1.29.1. A patch is available upstream; no fixed release is published yet.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
alpine/crunto a version that resolves this vulnerability.Fixed in 1.30.1-r0
Event History
Frequently Asked Questions
Which deployments are affected?
Affected deployments use crun 1.29 or 1.29.1 built with libkrun, start containers rootful, and enable passt networking through krun.use_passt.
What does an attacker need to exploit this issue?
The attacker needs their payload to be present in a container image that is run under the affected configuration. The payload can then be executed with host root privileges.
How can I assess whether my environment is vulnerable?
Check whether crun is version 1.29 or 1.29.1, whether it was built with libkrun, and whether rootful containers are launched with krun.use_passt enabled.
What should be done if a fixed release is not available?
An upstream patch is available, but no fixed release has been published. Until a fixed release is available, avoid the affected combination of rootful execution, libkrun, and krun.use_passt.