Kata Containers runtime-rs guest-root to host-root escape via virtiofs

CVE-2026-47243 is a Kata Containers runtime-rs guest-to-host escape in the standalone virtio-fs path. On affected deployments, virtiofsd is launched as host root with sandboxing and seccomp disabled, so a guest attacker with root-equivalent code execution inside the Kata guest VM can send raw FUSE messages and create host-root-owned symlinks outside the shared directory. The GitHub advisory marks runtime-rs <= 3.30.0 as affected, with the fix in 3.31.0; the verified bad configuration used rootless = false and shared_fs = "virtio-fs", and the issue was reproduced with QEMU and Cloud Hypervisor.

paragraphs

Why this verdict

• Downward pressure: requires guest-root first. Attacker position is authenticated/inside the guest VM, which implies the attacker has already cleared an earlier compromise stage. That sharply narrows the reachable population versus a front-door remote bug, and modern workload policy, admission control, and earlier-stage detections should stop many chains before this CVE matters.
• Downward pressure: narrow affected population. The bug needs Kata runtime-rs, not Kata broadly, and specifically the standalone virtio-fs path with rootless = false on versions <= 3.30.0. That is a much smaller slice of enterprise reality than the raw host-root impact suggests.
• Upward pressure: boundary break is complete and public. Public PoC details show a reliable path from guest root to host root by abusing unsandboxed virtiofsd. Once exploited, blast radius jumps from one workload to the Kubernetes node / host, which is exactly the kind of amplifier that keeps this out of MEDIUM.

Why not higher?

It is not an unauthenticated remote exploit, not broadly internet-reachable, and not even a generic Kata flaw. The chain assumes prior control inside the guest plus a specific runtime-rs deployment model, and I found no KEV listing or active exploitation evidence to justify CRITICAL.

Why not lower?

The impact is not cosmetic or tenant-local: the published PoC reaches host-root. If you deliberately deployed Kata to contain untrusted workloads, a bug that collapses that boundary deserves more than backlog treatment even with the prerequisite friction.

1. Inventory all Kata runtime-rs nodes — Find every node running Kata and separate runtime-rs from runtime-go, then flag hosts on <= 3.30.0 using shared_fs = "virtio-fs" with rootless = false. For a HIGH verdict, complete this scoping and exposure labeling within 30 days.
2. Move untrusted workloads off affected runtime-rs pools — The exploit only matters after the attacker gets guest-root, so cut risk by keeping multi-tenant, hostile, or highly privileged workloads off affected Kata runtime-rs nodes until the vendor fix is deployed. Under the HIGH bucket, make this segregation change within 30 days where patching cannot land immediately.
3. Disable the vulnerable path where feasible — If your design allows it, switch away from the verified bad combination of standalone virtio-fs + rootless = false in runtime-rs, or use a non-affected runtime path while you remediate. Treat that as the main compensating control and deploy it within 30 days.
4. Watch host integrity choke points — Add or tune FIM/audit coverage for /etc/cron.d, suspicious symlink creation, and anomalous root activity spawned by cron or other privileged host consumers. This will not prevent exploitation, but it can compress dwell time and should be deployed within 30 days on exposed node pools.

Run this on the target Linux host that provides Kata runtime services, not from an auditor workstation. Invoke it as sudo bash check-cve-2026-47243.sh or sudo bash check-cve-2026-47243.sh /opt/kata/share/defaults/kata-containers/runtime-rs/configuration-qemu-runtime-rs.toml; it needs root only to reliably read installed configs across standard Kata paths.

#!/usr/bin/env bash
# check-cve-2026-47243.sh
# Detect likely exposure to CVE-2026-47243 on a Linux host running Kata Containers.
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -u

TARGET_CONFIG="${1:-}"
STATUS="UNKNOWN"
EXIT_CODE=2
DETAILS=()

add_detail() {
  DETAILS+=("$1")
}

ver_ge() {
  # returns 0 if $1 >= $2
  [ "$(printf '%s\n%s\n' "$1" "$2" | sort -V | tail -n1)" = "$1" ]
}

ver_lt() {
  # returns 0 if $1 < $2
  ! ver_ge "$1" "$2"
}

trim_quotes() {
  printf '%s' "$1" | sed -E 's/^[[:space:]]*"?//; s/"?[[:space:]]*$//'
}

get_version() {
  local out v
  if command -v containerd-shim-kata-v2 >/dev/null 2>&1; then
    out="$(containerd-shim-kata-v2 --version 2>/dev/null | head -n1)"
    v="$(printf '%s' "$out" | grep -Eo '[0-9]+\.[0-9]+\.[0-9]+' | head -n1)"
    if [ -n "$v" ]; then
      printf '%s' "$v"
      return 0
    fi
  fi
  if command -v kata-runtime >/dev/null 2>&1; then
    out="$(kata-runtime --version 2>/dev/null | head -n3)"
    v="$(printf '%s' "$out" | grep -Eo '[0-9]+\.[0-9]+\.[0-9]+' | head -n1)"
    if [ -n "$v" ]; then
      printf '%s' "$v"
      return 0
    fi
  fi
  return 1
}

find_configs() {
  if [ -n "$TARGET_CONFIG" ]; then
    [ -f "$TARGET_CONFIG" ] && printf '%s\n' "$TARGET_CONFIG"
    return 0
  fi

  find \
    /opt/kata/share/defaults/kata-containers \
    /usr/share/defaults/kata-containers \
    /etc/kata-containers \
    /usr/share/kata-containers \
    -type f \( -name 'configuration-*-runtime-rs.toml' -o -name '*runtime-rs*.toml' \) 2>/dev/null | sort -u
}

parse_key() {
  local file="$1"
  local key="$2"
  awk -F= -v k="$key" '
    $0 ~ "^[[:space:]]*" k "[[:space:]]*=" {
      val=$2
      sub(/^[[:space:]]*/, "", val)
      sub(/[[:space:]]*#.*/, "", val)
      print val
      exit
    }
  ' "$file"
}

VERSION=""
if VERSION="$(get_version)"; then
  add_detail "detected_version=$VERSION"
else
  add_detail "detected_version=unknown"
fi

mapfile -t CONFIGS < <(find_configs)
if [ "${#CONFIGS[@]}" -eq 0 ]; then
  add_detail "runtime_rs_config=not_found"
  if [ -n "$VERSION" ] && ver_ge "$VERSION" "3.31.0"; then
    STATUS="PATCHED"
    EXIT_CODE=0
  fi
  printf '%s\n' "$STATUS"
  printf '%s\n' "$(IFS='; '; echo "${DETAILS[*]}")"
  exit "$EXIT_CODE"
fi

EXPOSED_CONFIG=0
CHECKED_ANY=0
for cfg in "${CONFIGS[@]}"; do
  CHECKED_ANY=1
  rootless_raw="$(parse_key "$cfg" 'rootless')"
  shared_fs_raw="$(parse_key "$cfg" 'shared_fs')"
  daemon_raw="$(parse_key "$cfg" 'virtio_fs_daemon')"

  rootless="$(trim_quotes "$rootless_raw")"
  shared_fs="$(trim_quotes "$shared_fs_raw")"
  daemon="$(trim_quotes "$daemon_raw")"

  [ -z "$rootless" ] && rootless="unknown"
  [ -z "$shared_fs" ] && shared_fs="unknown"
  [ -z "$daemon" ] && daemon="unknown"

  add_detail "config=$cfg rootless=$rootless shared_fs=$shared_fs virtio_fs_daemon=$daemon"

  if [ "$rootless" = "false" ] && [ "$shared_fs" = "virtio-fs" ]; then
    EXPOSED_CONFIG=1
  fi
done

if [ -n "$VERSION" ] && ver_ge "$VERSION" "3.31.0"; then
  STATUS="PATCHED"
  EXIT_CODE=0
elif [ -n "$VERSION" ] && ver_lt "$VERSION" "3.31.0" && [ "$EXPOSED_CONFIG" -eq 1 ]; then
  STATUS="VULNERABLE"
  EXIT_CODE=1
elif [ -n "$VERSION" ] && ver_lt "$VERSION" "3.31.0" && [ "$CHECKED_ANY" -eq 1 ]; then
  STATUS="UNKNOWN"
  EXIT_CODE=2
else
  STATUS="UNKNOWN"
  EXIT_CODE=2
fi

printf '%s\n' "$STATUS"
printf '%s\n' "$(IFS='; '; echo "${DETAILS[*]}")"
exit "$EXIT_CODE"

Sources

1. GitHub Security Advisory GHSA-2gv2-cffp-j227
2. OSV entry for GHSA-2gv2-cffp-j227 / CVE-2026-47243
3. Kata Containers 3.31.0 release notes
4. Fix commit 555b773
5. oss-sec disclosure
6. CISA Known Exploited Vulnerabilities Catalog
7. GitLab Advisory Database entry
8. SecurityOnline summary