OESA-2026-4568: containerd security update
containerd is an industry-standard container runtime with an emphasis on simplicity, robustness and portability. It is available as a daemon for Linux and Windows, which can manage the complete container lifecycle of its host system: image transfer and storage, container execution and supervision, low-level storage and network attachments, etc. Security Fix(es):
containerd is an open-source container runtime. Prior to 1.7.35, 2.0.12, 2.2.8, and 2.3.5, containerd's layer unpack handler repeatedly traverses directories for certain opaque whiteout configurations. A malicious image layer can trigger repeated directory traversals while opaque whiteouts are processed. Pulling or importing the image can consume CPU, delay container startup, and reduce image-pull concurrency for unrelated deployments. This issue is fixed in versions 1.7.35, 2.0.12, 2.2.8, and 2.3.5.(CVE-2026-95838)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
openeuler/containerdto a version that resolves this vulnerability.Fixed in 1.2.0-330.oe2203sp4 - Upgrade
Upgrade
containerdto a version that resolves this vulnerability.Fixed in 1.7.35 - Upgrade
Upgrade
containerdto a version that resolves this vulnerability.Fixed in 2.0.12 - Upgrade
Upgrade
containerdto a version that resolves this vulnerability.Fixed in 2.2.8 - Upgrade
Upgrade
containerdto a version that resolves this vulnerability.Fixed in 2.3.5
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems running affected containerd versions that pull or import untrusted or malicious container images are exposed. The impact occurs during image layer unpacking, before a container needs to start successfully.
What does an attacker need to do to exploit it?
An attacker needs to provide an image containing a layer with certain opaque whiteout configurations and have that image pulled or imported by the affected containerd instance. No authentication or privileges on the host are indicated, but user interaction is required to initiate the pull or import.
What is the operational impact?
Processing the malicious image can consume CPU, delay container startup, and reduce image-pull concurrency for unrelated deployments. The provided severity information indicates availability impact only, with no stated confidentiality or integrity impact.
Which versions contain the fix?
The issue is fixed in containerd 1.7.35, 2.0.12, 2.2.8, and 2.3.5. Versions prior to those releases in their respective version lines are affected.