CVE-2026-95837: containerd CRI plugin: Checkpoint restore bypasses destination security context
containerd is an open-source container runtime. From 2.1.0 until 2.2.7 and 2.3.4, containerd's CRI CreateContainer checkpoint restore is vulnerable because CRIU restores process security state from checkpoint data instead of enforcing the destination ContainerConfig. An attacker who can create a container from a crafted checkpoint can supply restored credentials, capabilities, nonewprivs, and seccomp state. The restored process can run as root with full capabilities and no enforced seccomp filters while CRI status reports the requested configuration. Systems that do not use CRI checkpoint restore are not affected. This issue is fixed in versions 2.2.7 and 2.3.4.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
containerdto a version that resolves this vulnerability.Fixed in 2.2.7 - Upgrade
Upgrade
containerdto a version that resolves this vulnerability.Fixed in 2.3.4
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Only systems that use the containerd CRI plugin's CreateContainer checkpoint restore functionality are affected. Systems that do not use CRI checkpoint restore are not affected.
What access does an attacker need to exploit it?
The attacker needs the ability to create a container from a crafted checkpoint. The provided severity vector indicates this is locally exploitable and requires low privileges, with no user interaction.
What can a crafted checkpoint cause after restoration?
It can restore attacker-controlled credentials, capabilities, no_new_privs, and seccomp state instead of applying the destination ContainerConfig. This can result in a process running as root with full capabilities and without enforced seccomp filters, while CRI status reports the requested configuration.
How can I determine whether a restored container is affected?
Compare the process's actual credentials, capabilities, no_new_privs setting, and seccomp state with the destination ContainerConfig. Affected restores may have privileged runtime state even though CRI status reports the requested configuration.
What versions contain the fix?
The issue is fixed in containerd versions 2.2.7 and 2.3.4. Versions from 2.1.0 up to those fixed releases are affected when CRI checkpoint restore is used.