A flaw was found in crun. After pivot_root, reopening /dev/null for stdio can follow a symlink and attach a host file to container stdio, then change that file's ownership. Affected versions are crun 1.29.1 and earlier. Default configurations that mount a fresh /dev are not exposed. No fixed release is available yet.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - A flaw was found in crun. When crun is built with libkrun and a container is started rootful with passt
    networking (krun.use_passt), crun can execute attacker-controlled payload from the container image with
    host root privileges. The issue is a regression in crun 1.29. It affects crun >= 1.29 (CVE-2026-84042)

  - A flaw was found in crun. When the container configuration does not give /dev a dedicated mount, terminal
    setup can redirect /dev/console onto an attacker-controlled path, including via the read-only-rootfs bind-
    mount fallback. Affected versions are crun 1.29.1 and earlier. Default configurations that mount a fresh
    /dev are not exposed. No fixed release is available yet. (CVE-2026-88264)

  - A flaw was found in crun. After pivot_root, reopening /dev/null for stdio can follow a symlink and attach
    a host file to container stdio, then change that file's ownership. Affected versions are crun 1.29.1 and
    earlier. Default configurations that mount a fresh /dev are not exposed. No fixed release is available
    yet. (CVE-2026-88265)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A flaw was found in crun. After pivot_root, reopening /dev/null for stdio can follow a symlink and attach     a host file to container stdio, then change that file's ownership. Affected versions are crun 1.29.1 and     earlier. Default configurations that mount a fresh /dev are not exposed. No fixed release is available     yet. (CVE-2026-88265)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
448442	Alpine: multiple crun packages: security update to 1.30.1-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	Local	high
448442	Alpine: multiple crun packages: security update to 1.30.1-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	Local	high
344698	Linux Distros Unpatched Vulnerability : CVE-2026-88265	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-88265

medium

Tenable Plugins

high

high

medium