runc is a CLI tool for spawning and running containers according to the OCI specification

CVE-2026-41579 is a symlink-following bug in runc's rootfs setup. When runc processes a container image where /dev is a symlink to somewhere else, setupPtmx and setupDevSymlinks naively call os.Remove and os.Symlink against filepath.Join(rootfs, '/dev/ptmx') — which, because filepath.Join resolves symlinks poorly, ends up pointing at a host directory. The attacker gets to delete a file named ptmx in any pre-existing host directory or drop a fixed set of symlinks (fd, stdin, stdout, stderr, core) with hardcoded targets. Affected: runc < 1.3.6, < 1.4.3, < 1.5.0-rc.3.

The vendor's LOW / 3.3 (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) is *broadly* correct: no confidentiality loss, no availability loss, no container escape, no code execution — just a narrow integrity primitive exercised by a chosen image at container-start time. But 3.3 undersells the practical picture slightly. Docker masks the flaw with its top-level ro overlay, but Podman and containerd do not, and rootless-Podman users are pulling untrusted images all day. A well-chosen symlink target (e.g. clobbering a systemd unit's ptmx sentinel, or dropping symlinks into a config-scan directory) is a plausible local persistence / tampering primitive. We nudge to MEDIUM (4.5) to reflect the Podman/containerd exposure gap — still nowhere near HIGH.

Why this verdict

• Impact is integrity-only and shape-constrained. The primitive is delete-a-file-named-ptmx and drop-a-fixed-set-of-symlinks — attacker picks the directory, not the payload. That is not a general-purpose write.
• Docker is out of scope. Docker's top-level ro layer masks the malicious /dev symlink. In a fleet where Docker dominates the desktop and CI footprint, exposure is materially smaller than the runc install base suggests.
• User interaction required. UI:R means someone or something must pull and run the malicious image. Registry allowlists, cosign policy, and Kyverno/OPA admission cut the exposed population further.
• Role multiplier — container runtime on Kubernetes nodes: the affected component IS a canonical high-value-role component (runs under kubelet/containerd on every worker). Chain succeeds under containerd/CRI-O, but blast radius is capped at *host filesystem tamper*, not node takeover or cluster pivot. That prevents downgrade to LOW but does not lift us to HIGH.
• Role multiplier — developer workstation with Podman: chain succeeds, blast radius is single-user files. Adds a MEDIUM-amplifier signal, not a floor.

Why not higher?

There is no confidentiality impact, no availability impact, no code execution, and no namespace/cgroup escape. The primitive cannot be turned into RCE without a second, unrelated vuln in a host process that consumes the tampered files. HIGH is reserved for chains that end in host or cluster compromise on their own.

Why not lower?

Vendor LOW (3.3) underweights the Podman/containerd exposure gap and the role-multiplier fact that runc runs on every Kubernetes node. In multi-tenant Kubernetes and shared build environments, a malicious image is a realistic threat model — LOW invites deprioritization past the 1-year mark, which is too long for a runtime component this central.

1. Enforce signed-image admission (cosign + Kyverno/OPA Gatekeeper) — Blocks the delivery vector at the door — malicious untrusted images cannot reach a vulnerable runc. Deploy within the 365-day remediation window; no mitigation SLA applies at MEDIUM, but this control has payoff far beyond this CVE.
2. Pin container runtime to Docker where feasible on shared multi-tenant hosts — Docker's overlay masks the /dev symlink and makes the flaw unexploitable. Only a valid interim on hosts where Podman/containerd isn't functionally required.
3. Enable SELinux container_t or AppArmor runc-default profiles in enforcing mode — MAC policy denies the cross-namespace host write even when runc mis-resolves the path. Verify with sestatus / aa-status and audit denials via ausearch -m AVC.
4. Add auditd + FIM watches on /etc, /usr/local/etc, and container-config directories — auditd -w /etc -p wa -k runc-symlink plus AIDE/Wazuh FIM catches the primitive if it fires. Detection floor while you roll patched runc.
5. Roll patched runc (1.3.6 / 1.4.3 / 1.5.0-rc.3) via container runtime package upgrade — Update containerd.io, podman, or vendor node image. Kubernetes node fleets: rebuild AMIs / node images and cordon-drain-replace. Complete within the 365-day noisgate remediation window; prioritize multi-tenant clusters.

Run on each Linux host that executes containers (Kubernetes nodes, build agents, developer workstations). Requires read access to the runc binary — no root needed. Invoke as ./check-cve-2026-41579.sh (optionally ./check-cve-2026-41579.sh /usr/local/sbin/runc to override the binary path).

#!/usr/bin/env bash
# check-cve-2026-41579.sh — detect vulnerable runc versions
# Fixed in: 1.3.6, 1.4.3, 1.5.0-rc.3
# Exit: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -u
RUNC_BIN="${1:-$(command -v runc 2>/dev/null)}"

if [ -z "${RUNC_BIN}" ] || [ ! -x "${RUNC_BIN}" ]; then
  # Try common containerd-bundled paths
  for p in /usr/bin/runc /usr/sbin/runc /usr/local/bin/runc /usr/local/sbin/runc /run/torcx/bin/runc; do
    [ -x "$p" ] && RUNC_BIN="$p" && break
  done
fi

if [ -z "${RUNC_BIN}" ] || [ ! -x "${RUNC_BIN}" ]; then
  echo "UNKNOWN: runc binary not found"
  exit 2
fi

RAW=$("${RUNC_BIN}" --version 2>/dev/null | head -n1)
# Expect: 'runc version 1.2.5' or 'runc version 1.5.0-rc.3'
VER=$(echo "${RAW}" | awk '{print $3}')
if [ -z "${VER}" ]; then
  echo "UNKNOWN: could not parse version from: ${RAW}"
  exit 2
fi

# Split into major.minor.patch and optional -rc.N
CORE=${VER%%-*}
SUFFIX=${VER#${CORE}}
IFS='.' read -r MAJ MIN PAT <<< "${CORE}"
MAJ=${MAJ:-0}; MIN=${MIN:-0}; PAT=${PAT:-0}

vuln=1  # assume vulnerable
case "${MAJ}.${MIN}" in
  1.3)
    [ "${PAT}" -ge 6 ] && vuln=0
    ;;
  1.4)
    [ "${PAT}" -ge 3 ] && vuln=0
    ;;
  1.5)
    if [ "${PAT}" -ge 0 ]; then
      # 1.5.0-rc.3 or later is fixed; 1.5.0-rc.1/rc.2 are vulnerable
      if [ -z "${SUFFIX}" ]; then
        vuln=0  # 1.5.0 GA
      else
        RC=$(echo "${SUFFIX}" | sed -n 's/^-rc\.\([0-9]\+\).*/\1/p')
        [ -n "${RC}" ] && [ "${RC}" -ge 3 ] && vuln=0
      fi
    fi
    ;;
  *)
    # 1.6+ or 2.x — assume fixed
    if [ "${MAJ}" -gt 1 ] || { [ "${MAJ}" -eq 1 ] && [ "${MIN}" -gt 5 ]; }; then
      vuln=0
    fi
    ;;
esac

if [ ${vuln} -eq 0 ]; then
  echo "PATCHED: ${RUNC_BIN} version ${VER}"
  exit 0
else
  echo "VULNERABLE: ${RUNC_BIN} version ${VER} — upgrade to 1.3.6 / 1.4.3 / 1.5.0-rc.3+"
  exit 1
fi

Sources

1. GHSA-xjvp-4fhw-gc47 (runc security advisory)
2. Miggo vulnerability database — CVE-2026-41579
3. Debian security tracker — CVE-2026-41579
4. Amazon Linux ALAS — CVE-2026-41579
5. GitLab advisory database — CVE-2026-41579
6. OffSeq Threat Radar — CVE-2026-41579
7. opencontainers/runc releases
8. Vulnerability-Lookup (CIRCL) — GHSA-XJVP-4FHW-GC47