VDB
RHSA-2026%3A2034
RHSA-2026%3A2034
PUBLISHED
CVSS 8.199999809265137 HIGH
A flaw was found in runc. This attack is a more sophisticated variant of CVE-2019-16884, which was a flaw that allowed an attacker to trick runc into writing the LSM process labels for a container process into a dummy tmpfs file and thus not apply the correct LSM labels to the container process. The mitigation applied for CVE-2019-16884 was fairly limited and effectively only caused runc to verify that when we write LSM labels that those labels are actual procfs files.
Risk Scores
CVSS 3.1
8.199999809265137
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/odf4/odf-rhel9-operator@sha256:d1ee7b98fe83c3331b8dfb1d231316925790e6beb7a55e616362601de8f921b0_s390x as a component of Red Hat Openshift Data Foundation 4.2 | *, *, * |
| Red Hat | registry.redhat.io/odf4/odf-multicluster-rhel9-operator@sha256:0ce5030d1d6cdf8ce1bd982d5f3f93bc8f4d72ee2def282076d73718d0176e81_ppc64le as a component of Red Hat Openshift Data Foundation 4.2 | *, *, registry.redhat.io/odf4/odf-multicluster-rhel9-operator@sha256:0ce5030d1d6cdf8ce1bd982d5f3f93bc8f4d72ee2def282076d73718d0176e81_ppc64le |
| Red Hat | registry.redhat.io/odf4/mcg-operator-bundle@sha256:c3d33857815dd433a0c969f9a6ab0630a3e06de191dcb297a061bbd14ef874a8_amd64 as a component of Red Hat Openshift Data Foundation 4.2 | registry.redhat.io/odf4/mcg-operator-bundle@sha256:c3d33857815dd433a0c969f9a6ab0630a3e06de191dcb297a061bbd14ef874a8_amd64, *, registry.redhat.io/odf4/mcg-operator-bundle@sha256:c3d33857815dd433a0c969f9a6ab0630a3e06de191dcb297a061bbd14ef874a8_amd64 |
| Red Hat | registry.redhat.io/odf4/odf-rhel9-operator@sha256:31358e356edeb9e3d5a724f940ed0e3ff7255069e944f871155558db64b92809_ppc64le as a component of Red Hat Openshift Data Foundation 4.2 | registry.redhat.io/odf4/odf-rhel9-operator@sha256:31358e356edeb9e3d5a724f940ed0e3ff7255069e944f871155558db64b92809_ppc64le, registry.redhat.io/odf4/odf-rhel9-operator@sha256:31358e356edeb9e3d5a724f940ed0e3ff7255069e944f871155558db64b92809_ppc64le, registry.redhat.io/odf4/odf-rhel9-operator@sha256:31358e356edeb9e3d5a724f940ed0e3ff7255069e944f871155558db64b92809_ppc64le |
| Red Hat | registry.redhat.io/odf4/odf-external-snapshotter-rhel9-operator@sha256:8c3a902848ea7820af87a14d52c512918c122b8c2d440825c6c5b1d239bfd9ed_arm64 as a component of Red Hat Openshift Data Foundation 4.2 | *, *, * |
| Red Hat | registry.redhat.io/odf4/odf-console-rhel9@sha256:b17aeb81cc978e6872d5c27e02df5217c9860745507b20678557d0c9a6edfc1d_s390x as a component of Red Hat Openshift Data Foundation 4.2 | *, *, * |
| Red Hat | registry.redhat.io/odf4/odf-external-snapshotter-sidecar-rhel9@sha256:ac2a9f9ef9a75f87627fc6cdd5e3c5d09927cb9c494c43c6a8b4ed516ff59827_ppc64le as a component of Red Hat Openshift Data Foundation 4.2 | registry.redhat.io/odf4/odf-external-snapshotter-sidecar-rhel9@sha256:ac2a9f9ef9a75f87627fc6cdd5e3c5d09927cb9c494c43c6a8b4ed516ff59827_ppc64le, *, * |
| Red Hat | registry.redhat.io/odf4/odf-cloudnative-pg-rhel9-operator@sha256:e95420ef06e80e6fd4e1ee91e0db0c098475706149ac59a46aac749c674683c8_s390x as a component of Red Hat Openshift Data Foundation 4.2 | registry.redhat.io/odf4/odf-cloudnative-pg-rhel9-operator@sha256:e95420ef06e80e6fd4e1ee91e0db0c098475706149ac59a46aac749c674683c8_s390x, *, registry.redhat.io/odf4/odf-cloudnative-pg-rhel9-operator@sha256:e95420ef06e80e6fd4e1ee91e0db0c098475706149ac59a46aac749c674683c8_s390x |
| Red Hat | registry.redhat.io/odf4/odr-cluster-operator-bundle@sha256:9be5b29836dbbe948ecdee32e7ccd66f8364e282507961b7e68aa1f28069b0e2_amd64 as a component of Red Hat Openshift Data Foundation 4.2 | registry.redhat.io/odf4/odr-cluster-operator-bundle@sha256:9be5b29836dbbe948ecdee32e7ccd66f8364e282507961b7e68aa1f28069b0e2_amd64, *, registry.redhat.io/odf4/odr-cluster-operator-bundle@sha256:9be5b29836dbbe948ecdee32e7ccd66f8364e282507961b7e68aa1f28069b0e2_amd64 |
| Red Hat | registry.redhat.io/odf4/odf-external-snapshotter-sidecar-rhel9@sha256:a73c6d1b56091549ef5ab60cefd430015c993de19b9d157dd19bfdc5e038b659_arm64 as a component of Red Hat Openshift Data Foundation 4.2 | *, *, registry.redhat.io/odf4/odf-external-snapshotter-sidecar-rhel9@sha256:a73c6d1b56091549ef5ab60cefd430015c993de19b9d157dd19bfdc5e038b659_arm64 |
| Red Hat | registry.redhat.io/odf4/odf-console-rhel9@sha256:f09054e61b19d65b371f56cb3a59117a12efb673d0a449e1b606249996c3a9e8_arm64 as a component of Red Hat Openshift Data Foundation 4.2 | *, *, * |
| Red Hat | registry.redhat.io/odf4/cephcsi-rhel9@sha256:41847351964d7b0c4393f868837ee7288b48e3c92371a67d75f7977ef8ef32c7_ppc64le as a component of Red Hat Openshift Data Foundation 4.2 | registry.redhat.io/odf4/cephcsi-rhel9@sha256:41847351964d7b0c4393f868837ee7288b48e3c92371a67d75f7977ef8ef32c7_ppc64le, registry.redhat.io/odf4/cephcsi-rhel9@sha256:41847351964d7b0c4393f868837ee7288b48e3c92371a67d75f7977ef8ef32c7_ppc64le, registry.redhat.io/odf4/cephcsi-rhel9@sha256:41847351964d7b0c4393f868837ee7288b48e3c92371a67d75f7977ef8ef32c7_ppc64le |
| Red Hat | registry.redhat.io/odf4/ocs-client-rhel9-operator@sha256:08f47e4efeb6197ab1b75d33a4a54e98c188719b7eef276341cb7cb3523c368a_arm64 as a component of Red Hat Openshift Data Foundation 4.2 | registry.redhat.io/odf4/ocs-client-rhel9-operator@sha256:08f47e4efeb6197ab1b75d33a4a54e98c188719b7eef276341cb7cb3523c368a_arm64, *, registry.redhat.io/odf4/ocs-client-rhel9-operator@sha256:08f47e4efeb6197ab1b75d33a4a54e98c188719b7eef276341cb7cb3523c368a_arm64 |
| Red Hat | registry.redhat.io/odf4/mcg-core-rhel9@sha256:cdaa7e616d6f1681689ac009b8362e76013f058ba224c9dc935d056d4200a574_ppc64le as a component of Red Hat Openshift Data Foundation 4.2 | *, *, * |
| Red Hat | registry.redhat.io/odf4/odf-multicluster-console-rhel9@sha256:c8caff42580dbb2e1917f3e09781c144a41ea0a41c8712687a529123f06ebc3f_s390x as a component of Red Hat Openshift Data Foundation 4.2 | registry.redhat.io/odf4/odf-multicluster-console-rhel9@sha256:c8caff42580dbb2e1917f3e09781c144a41ea0a41c8712687a529123f06ebc3f_s390x, registry.redhat.io/odf4/odf-multicluster-console-rhel9@sha256:c8caff42580dbb2e1917f3e09781c144a41ea0a41c8712687a529123f06ebc3f_s390x, registry.redhat.io/odf4/odf-multicluster-console-rhel9@sha256:c8caff42580dbb2e1917f3e09781c144a41ea0a41c8712687a529123f06ebc3f_s390x |
| Red Hat | registry.redhat.io/odf4/ocs-rhel9-operator@sha256:c9dc60948b3c0a0d255f8d68ddd9ff6da7e22f511d1ff9bd90af8c674d305fd5_ppc64le as a component of Red Hat Openshift Data Foundation 4.2 | registry.redhat.io/odf4/ocs-rhel9-operator@sha256:c9dc60948b3c0a0d255f8d68ddd9ff6da7e22f511d1ff9bd90af8c674d305fd5_ppc64le, registry.redhat.io/odf4/ocs-rhel9-operator@sha256:c9dc60948b3c0a0d255f8d68ddd9ff6da7e22f511d1ff9bd90af8c674d305fd5_ppc64le, * |
| Red Hat | registry.redhat.io/odf4/odf-dependencies-operator-bundle@sha256:29002831ef90fefd9b4905fea80c62791928c935c42746dff00a523c27d45d4a_amd64 as a component of Red Hat Openshift Data Foundation 4.2 | registry.redhat.io/odf4/odf-dependencies-operator-bundle@sha256:29002831ef90fefd9b4905fea80c62791928c935c42746dff00a523c27d45d4a_amd64, *, * |
| Red Hat | registry.redhat.io/odf4/odf-external-snapshotter-rhel9-operator@sha256:ebfcb5157678c7bcb33eb299d8ec956e61bd1e5de61bc80d6f65fd09df2a48ad_ppc64le as a component of Red Hat Openshift Data Foundation 4.2 | registry.redhat.io/odf4/odf-external-snapshotter-rhel9-operator@sha256:ebfcb5157678c7bcb33eb299d8ec956e61bd1e5de61bc80d6f65fd09df2a48ad_ppc64le, *, registry.redhat.io/odf4/odf-external-snapshotter-rhel9-operator@sha256:ebfcb5157678c7bcb33eb299d8ec956e61bd1e5de61bc80d6f65fd09df2a48ad_ppc64le |
| Red Hat | registry.redhat.io/odf4/ocs-metrics-exporter-rhel9@sha256:2835a2b11d8a5d11f7a84dec115d85825e3a310c16c9f0b093b54f0320316326_ppc64le as a component of Red Hat Openshift Data Foundation 4.2 | *, *, * |
| Red Hat | registry.redhat.io/odf4/ocs-rhel9-operator@sha256:c9dc60948b3c0a0d255f8d68ddd9ff6da7e22f511d1ff9bd90af8c674d305fd5_ppc64le as a component of Red Hat Openshift Data Foundation 4.2 | *, registry.redhat.io/odf4/ocs-rhel9-operator@sha256:c9dc60948b3c0a0d255f8d68ddd9ff6da7e22f511d1ff9bd90af8c674d305fd5_ppc64le, * |
…and 186 more
Timeline
- Feb 5, 2026 CVE Published
- Apr 25, 2026 Distribution Patch
- May 10, 2026 Security Advisory
- May 16, 2026 Distribution Patch
- May 16, 2026 Security Advisory
- Jul 30, 2026 CVE Updated
References
- https://access.redhat.com/security/cve/CVE-2025-52881 advisory
- https://github.com/opencontainers/selinux/pull/237 advisory
- https://docs.redhat.com/en/documentation/red_hat_openshift_data_foundation/ advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_2034.json advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2404715 issue
- https://www.cve.org/CVERecord?id=CVE-2025-52881 advisory
- https://access.redhat.com/security/updates/classification/ advisory
- https://github.com/opencontainers/runc/security/advisories/GHSA-cgrx-mc8f-2prm advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-52881 advisory
- https://access.redhat.com/errata/RHSA-2026:2034 advisory