RHSA-2026:97561: Important: crun security, bug fix, and enhancement update

Q: Which deployments are directly exposed to the security issue?

The issue applies to rootful krun configurations that use passt. The affected condition allows a container payload to execute as root on the host.

Q: Which packages are covered by this update?

The update covers redhat/crun, redhat/crun-debuginfo, and redhat/crun-debugsource.

Q: What non-security changes are included?

The release adds a requirement for container-selinux and updates crun to the latest upstream release.

Published Nov 10, 2026

Updated

crun is a OCI runtimeSecurity Fix(es): crun: crun: rootful krun with passt executes container payload as host root (CVE-2026-84042) Bug Fix(es) and Enhancement(s): crun should require container-selinux (JIRA:RHEL-169227) update to the latest upstream release (JIRA:RHEL-185741) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.Additional Changes:For detailed information on changes in this release, see the Red Hat Enterprise Linux 9 Release Notes linked from the References section.

Affected Software

12 affected componentsFixes available

redhat/crun<1.29.1-1.el9

1.29.1-1.el9

redhat/crun<1.29.1-1.el9

1.29.1-1.el9

redhat/crun-debuginfo<1.29.1-1.el9

1.29.1-1.el9

redhat/crun-debugsource<1.29.1-1.el9

1.29.1-1.el9

redhat/crun-debuginfo<1.29.1-1.el9

1.29.1-1.el9

redhat/crun-debugsource<1.29.1-1.el9

1.29.1-1.el9

redhat/crun<1.29.1-1.el9

1.29.1-1.el9

redhat/crun-debuginfo<1.29.1-1.el9

1.29.1-1.el9

redhat/crun-debugsource<1.29.1-1.el9

1.29.1-1.el9

redhat/crun<1.29.1-1.el9.aa

1.29.1-1.el9.aa

redhat/crun-debuginfo<1.29.1-1.el9.aa

1.29.1-1.el9.aa

redhat/crun-debugsource<1.29.1-1.el9.aa

1.29.1-1.el9.aa

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade redhat/crun to a version that resolves this vulnerability.
Fixed in 1.29.1-1.el9
Upgrade
Upgrade redhat/crun-debuginfo to a version that resolves this vulnerability.
Fixed in 1.29.1-1.el9
Upgrade
Upgrade redhat/crun-debugsource to a version that resolves this vulnerability.
Fixed in 1.29.1-1.el9
Upgrade
Upgrade redhat/crun to a version that resolves this vulnerability.
Fixed in 1.29.1-1.el9.aa
Upgrade
Upgrade redhat/crun-debuginfo to a version that resolves this vulnerability.
Fixed in 1.29.1-1.el9.aa
Upgrade
Upgrade redhat/crun-debugsource to a version that resolves this vulnerability.
Fixed in 1.29.1-1.el9.aa

Event History

Nov 10, 2026

Advisory Published

via Red Hat·12:00 AM

Data Sourced

via Red Hat·12:00 AM

RemedyDescriptionAffected Software

Frequently Asked Questions

Which deployments are directly exposed to the security issue?

The issue applies to rootful krun configurations that use passt. The affected condition allows a container payload to execute as root on the host.

Which packages are covered by this update?

The update covers redhat/crun, redhat/crun-debuginfo, and redhat/crun-debugsource.

What non-security changes are included?

The release adds a requirement for container-selinux and updates crun to the latest upstream release.

RHSA-2026:97561: Important: crun security, bug fix, and enhancement update

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are directly exposed to the security issue?

Which packages are covered by this update?

What non-security changes are included?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are directly exposed to the security issue?

Which packages are covered by this update?

What non-security changes are included?