GHSA-2fgp-24rx-f2r7MediumCVSS 4.4
A flaw was found in the default seccomp profile used by Podman via containers-common. Deny rules...
🔗 CVE IDs covered (1)
📋 Description
A flaw was found in the default seccomp profile used by Podman via containers-common. Deny rules for AF_VSOCK and NETLINK_AUDIT compared socket arguments with unmasked 64-bit equality. Because the kernel truncates those int arguments to 32 bits, setting upper bits can bypass the deny rules.
🔗 References (7)
- https://nvd.nist.gov/vuln/detail/CVE-2026-123876
- https://github.com/podman-container-tools/container-libs/issues/1248
- https://github.com/podman-container-tools/container-libs/pull/1249
- https://access.redhat.com/security/cve/CVE-2026-123876
- https://bugzilla.redhat.com/show_bug.cgi?id=2566536
- https://www.openwall.com/lists/oss-security/2026/10/27/3
- https://github.com/advisories/GHSA-2fgp-24rx-f2r7