UBUNTU-CVE-2026-123876: Medium severity ubuntu/golang-github-containers-common vulnerability
Published Nov 9, 2026
·Updated
A flaw was found in the default seccomp profile used by Podman via containers-common. Deny rules for AFVSOCK and NETLINKAUDIT compared socket arguments with unmasked 64-bit equality. Because the kernel truncates those int arguments to 32 bits, setting upper bits can bypass the deny rules.
Affected Software
4 affected components
ubuntu/golang-github-containers-common*
ubuntu/golang-github-containers-common*
ubuntu/golang-github-containers-common*
ubuntu/golang-github-containers-common*
Event History
Nov 9, 2026
CVE Published
via OSV·12:00 AM
Data Sourced
via OSV·12:00 AM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
Which deployments are exposed by this issue?
Podman deployments using the default seccomp profile provided through containers-common are affected. The vulnerable rules are the profile's denials for AF_VSOCK and NETLINK_AUDIT sockets.
2
What access does an attacker need to exploit the bypass?
The reported vector requires local access and low privileges, with no user interaction. An attacker must invoke socket operations using values with upper 32-bit bits set so that the kernel truncation bypasses the profile's unmasked 64-bit comparisons.