RLSA-2026:97561: Important: crun security, bug fix, and enhancement update
crun is a OCI runtime
Security Fix(es):
crun: crun: rootful krun with passt executes container payload as host root (CVE-2026-84042)
Bug Fix(es) and Enhancement(s):
crun should require container-selinux (JIRA:Rocky Linux-169227)
update to the latest upstream release (JIRA:Rocky Linux-185741)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Rocky Linux 9 Release Notes linked from the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rocky-linux/crunto a version that resolves this vulnerability.Fixed in 0:1.29.1-1.el9 - Upgrade
Upgrade
rocky-linux/crun-debuginfoto a version that resolves this vulnerability.Fixed in 0:1.29.1-1.el9 - Upgrade
Upgrade
rocky-linux/crun-debugsourceto a version that resolves this vulnerability.Fixed in 0:1.29.1-1.el9
Event History
Frequently Asked Questions
Which systems are exposed to the privilege escalation issue?
The issue affects rootful krun use with passt, where the container payload can execute as host root. Systems not using that combination are not identified as affected by the provided advisory.
What level of access does an attacker need?
The supplied CVSS vector indicates local access, high attack complexity, low privileges required, and no user interaction. Successful exploitation can affect confidentiality, integrity, and availability at high impact.
Which Rocky Linux packages should be checked for updates?
Check for updates to crun. The advisory also lists crun-debuginfo and crun-debugsource as affected software packages.
Does the update include changes beyond the security fix?
Yes. It updates crun to the latest upstream release and adds a requirement for container-selinux.