DEBIAN-CVE-2026-123876: Debian/podman vulnerability

Published Nov 6, 2026

Updated

A flaw was found in the default seccomp profile used by Podman via containers-common. Deny rules for AFVSOCK and NETLINKAUDIT compared socket arguments with unmasked 64-bit equality. Because the kernel truncates those int arguments to 32 bits, setting upper bits can bypass the deny rules.

Affected Software

2 affected components

debian/podman*

Event History

Nov 6, 2026

CVE Published

via OSV·06:18 PM

Data Sourced

via OSV·06:18 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which deployments are exposed to this issue?

Deployments using Podman with the default seccomp profile supplied through containers-common are exposed. The affected deny rules are those intended to block AF_VSOCK and NETLINK_AUDIT sockets.

What must an attacker be able to do to bypass the restrictions?

An attacker needs the ability to cause socket arguments to be supplied with upper 32-bit values set. The kernel truncates these integer arguments to 32 bits, while the profile compares them as unmasked 64-bit values, allowing the deny-rule comparison to be bypassed.

Is a custom seccomp profile affected?

The data identifies the default seccomp profile used by Podman via containers-common. It does not establish whether custom profiles are affected; profiles with equivalent unmasked 64-bit equality checks for these socket arguments would require review.

DEBIAN-CVE-2026-123876: Debian/podman vulnerability

Affected Software

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What must an attacker be able to do to bypass the restrictions?

Is a custom seccomp profile affected?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What must an attacker be able to do to bypass the restrictions?

Is a custom seccomp profile affected?