runc is a CLI tool for spawning and running containers according to the OCI specification. In versions prior to 1.3.6, 1.4.0-rc.1, 1.4.0-rc.12, 1.5.0-rc.1, and 1.5.0-rc.1, when setting up the container rootfs, setupPtmx and setupDevSymlinks call os.Remove and os.Symlink with a filepath.Join string which allow an image with /dev as a symlink to trick runc into deleting files called ptmx on the host or creating a hardcoded set of symlinks with specific names and targets in an arbitrary pre-existing host directory. This issue is not exploitable under Docker, because Docker creates a top-level read-only layer that masks any malicious /dev symlink present in the container image — unlike some other Linux container tooling, whose higher-level runtimes built on runc remain exposed to exploitation via a malicious image. This issue has been fixed in versions 1.3.6, 1.4.3 and 1.5.0.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - runc is a CLI tool for spawning and running containers according to the OCI specification. In versions
    prior to 1.3.6, 1.4.0-rc.1, 1.4.0-rc.12, 1.5.0-rc.1, and 1.5.0-rc.1, when setting up the container rootfs,
    setupPtmx and setupDevSymlinks call os.Remove and os.Symlink with a filepath.Join string which allow an
    image with /dev as a symlink to trick runc into deleting files called ptmx on the host or creating a
    hardcoded set of symlinks with specific names and targets in an arbitrary pre-existing host directory.
    This issue is not exploitable under Docker, because Docker creates a top-level read-only layer that masks
    any malicious /dev symlink present in the container image — unlike some other Linux container tooling,
    whose higher-level runtimes built on runc remain exposed to exploitation via a malicious image. This issue
    has been fixed in versions 1.3.6, 1.4.3 and 1.5.0. (CVE-2026-41579)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - runc is a CLI tool for spawning and running containers according to the OCI specification. In versions     prior to 1.3.6, 1.4.0-rc.1, 1.4.0-rc.12, 1.5.0-rc.1, and 1.5.0-rc.1, when setting up the container rootfs,     setupPtmx and setupDevSymlinks call os.Remove and os.Symlink with a filepath.Join string which allow an     image with /dev as a symlink to trick runc into deleting files called ptmx on the host or creating a     hardcoded set of symlinks with specific names and targets in an arbitrary pre-existing host directory.
    This issue is not exploitable under Docker, because Docker creates a top-level read-only layer that masks     any malicious /dev symlink present in the container image  unlike some other Linux container tooling,     whose higher-level runtimes built on runc remain exposed to exploitation via a malicious image. This issue     has been fixed in versions 1.3.6, 1.4.3 and 1.5.0. (CVE-2026-41579)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
443778	SCA: security update for github.com/opencontainers/runc (GHSA-xjvp-4fhw-gc47)	Tenable Cloud Security	SCA Checks	medium
443778	SCA: security update for github.com/opencontainers/runc (GHSA-xjvp-4fhw-gc47)	Tenable Self-Hosted Container Security	SCA Checks	medium
443383	Alpine: multiple runc packages: security update to 1.4.3-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	low
443383	Alpine: multiple runc packages: security update to 1.4.3-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	low
320986	Linux Distros Unpatched Vulnerability : CVE-2026-41579	Nessus	Misc.	low

Detections

Analytics

CVE-2026-41579

medium

Tenable Plugins

medium

medium

low

low

low