CVE-2026-88265: Crun: crun: /dev/null symlink follow during stdio reopen allows host bind-mount write and chown
A flaw was found in crun. After pivotroot or chroot, crun reopens /dev/null for stdio without preventing symlink follows. If /dev is not mounted and a malicious image replaces /dev/null with a symlink, crun can open a host bind-mounted file and a non-root container process can write to it and chown it. Affected versions are crun 1.29.1 and earlier. This is a separate issue from CVE-2026-47766 and from the /dev/console symlink flaw. No fixed release is published yet.
Other sources
A flaw was found in crun. After pivotroot, reopening /dev/null for stdio can follow a symlink and attach a host file to container stdio, then change that file's ownership. Affected versions are crun 1.29.1 and earlier. Default configurations that mount a fresh /dev are not exposed. No fixed release is available yet.
— MITRE
Affected Software
Event History
Frequently Asked Questions
Are standard container deployments affected?
Default configurations that mount a fresh /dev are not exposed. The issue requires a setup where /dev is not mounted after pivot_root or chroot.
What conditions are required for exploitation?
A malicious image must be able to replace /dev/null with a symlink. The symlink must resolve to a host file that is bind-mounted into the container, allowing a non-root container process to write to that file and change its ownership.
Which crun versions are affected and is a fix available?
crun 1.29.1 and earlier are affected. No fixed release has been published.
What can be done while no fixed release is available?
Use configurations that mount a fresh /dev, which are described as not exposed. Avoid running untrusted images in configurations where /dev is absent and an image can control /dev/null.