RLSA-2026:98521: Important: bubblewrap security update
Bubblewrap (/usr/bin/bwrap) is a core execution engine for unprivileged containers that works as a setuid binary on kernels without user namespaces.
Security Fix(es):
bubblewrap: bubblewrap: symlink traversal via /oldroot allows writing files outside sandbox during setup (CVE-2026-87766)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rocky-linux/bubblewrapto a version that resolves this vulnerability.Fixed in 0:0.6.3-1.el9_8.1
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs local access and low-level privileges on the affected system, as reflected by the CVSS vector AV:L/PR:L. The issue affects environments where Bubblewrap is used to create unprivileged containers, particularly on kernels without user namespaces where /usr/bin/bwrap operates as a setuid binary.
What could a successful exploit allow?
During sandbox setup, symlink traversal through /oldroot can allow writing files outside the intended sandbox. The reported CVSS vector indicates high confidentiality, integrity, and availability impact, with scope changed.
How can I determine whether a system is affected?
Check whether the Rocky Linux bubblewrap package is installed and whether /usr/bin/bwrap is used for unprivileged container execution. Systems running kernels without user namespaces warrant particular attention because Bubblewrap operates as a setuid binary in that configuration.