REDHAT-BUG-2566536: Security vulnerability

Q: Which environments are affected?

The issue is confirmed in the containers-common seccomp.json shipped with RHEL 9 and RHEL 10. It affects 64-bit architectures because the bypass relies on supplying high-order bits that the kernel ignores for the socket domain argument.

Q: What does an attacker need to exploit this?

An attacker needs the ability to invoke socket(2) from a container using the affected default seccomp profile. They can provide a socket-domain value such as AF_VSOCK|1<<32, which bypasses the profile's 64-bit equality check while the kernel interprets the low 32 bits as AF_VSOCK.

Q: Are systems protected by SELinux still at risk?

SELinux on enforcing hosts may block some of the restricted socket operations. However, SELinux does not correct the seccomp policy defect: the affected seccomp profile itself fails to enforce its intended AF_VSOCK and NETLINK_AUDIT deny rules.

Published Nov 3, 2026

Updated

A flaw was found in containers-common (Podman/container-libs default seccomp profile). Deny rules for AFVSOCK and NETLINKAUDIT compared socket(2) integer arguments with unmasked 64-bit equality. On 64-bit architectures the kernel uses only the low 32 bits, so values such as AFVSOCK|1<<32 bypass the deny rule while still creating the restricted socket type. This is confirmed in RHEL 9 and RHEL 10 containers-common seccomp.json. SELinux may still block some of these operations on enforcing hosts, but the seccomp profile itself does not enforce the intended restriction.

Affected Software

0 affected components

Event History

Nov 3, 2026

Data Sourced

via Red Hat·09:59 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which environments are affected?

The issue is confirmed in the containers-common seccomp.json shipped with RHEL 9 and RHEL 10. It affects 64-bit architectures because the bypass relies on supplying high-order bits that the kernel ignores for the socket domain argument.

What does an attacker need to exploit this?

An attacker needs the ability to invoke socket(2) from a container using the affected default seccomp profile. They can provide a socket-domain value such as AF_VSOCK|1<<32, which bypasses the profile's 64-bit equality check while the kernel interprets the low 32 bits as AF_VSOCK.

Are systems protected by SELinux still at risk?

SELinux on enforcing hosts may block some of the restricted socket operations. However, SELinux does not correct the seccomp policy defect: the affected seccomp profile itself fails to enforce its intended AF_VSOCK and NETLINK_AUDIT deny rules.