CVE-2026-123876: 
Podman vulnerability analysis and mitigation

CVE-2026-123876 is a seccomp security feature bypass vulnerability in the default seccomp profile used by Podman via the containers-common package. The flaw arises because deny rules for AF_VSOCK and NETLINK_AUDIT socket families compare syscall arguments using unmasked 64-bit equality, while the Linux kernel truncates those int arguments to 32 bits — allowing an attacker to set upper bits to bypass the deny rules. Affected products include Red Hat's containers-common, podman, openshift/ose-rhel-coreos-8, and openshift/ose-rhel-coreos-9; specific fixed version numbers were not published at time of disclosure. The vulnerability was reported by Ricardo Branco (SUSE), disclosed publicly on October 27, 2026, and assigned a CVSS v3.1 base score of 4.4 (Medium) (Red Hat Advisory, GitHub Advisory).

The root cause is classified as CWE-184 (Incomplete List of Disallowed Inputs): the seccomp BPF filter evaluates syscall arguments as full 64-bit register values, but the Linux kernel's socket(2) syscall casts its int arguments to 32 bits, silently discarding the upper 32 bits (Red Hat Advisory, oss-security). A local attacker with low privileges can invoke socket(0x100000028, SOCK_STREAM, 0) — the seccomp rule checking arg0 == 0x28 (AF_VSOCK) evaluates to false because 0x100000028 != 0x28, so the deny rule is skipped and the syscall is allowed; the kernel then truncates the argument to 0x28 and opens the restricted socket (GitHub Issue #1248). The same bypass applies to NETLINK_AUDIT (without CAP_AUDIT_WRITE). The fix replaces plain equality comparisons with SCMP_CMP_MASKED_EQ to compare only the low 32 bits (GitHub PR #1249). This pattern was confirmed on x86_64 with Podman v6.1.3 on Fedora 45 Beta, and also affects RHEL 9 and RHEL 10 containers-common seccomp.json profiles (Red Hat Bugzilla).

A local user with low privileges running a container under Podman can bypass the seccomp deny rules intended to block access to AF_VSOCK (VM socket) and NETLINK_AUDIT socket families, potentially enabling unauthorized vsock-based communication channels (which were originally restricted to prevent container escapes via VM sockets) and access to audit log data via NETLINK_AUDIT (Red Hat Advisory, GitHub Issue #1248). The confidentiality and integrity impacts are both rated Low, with no availability impact; the scope is unchanged, meaning the bypass is contained within the container's privilege context. On SELinux-enforcing hosts, the LSM may still block vsock access independently, but on hosts without a confining LSM, the seccomp profile is the sole protection and it fails (oss-security).

No public proof-of-concept exploit code has been published, and there is no evidence of in-the-wild exploitation at this time (GitHub Advisory). The vulnerability requires local access with low privileges and no user interaction, making it relatively straightforward to exploit for any user who can run containers under Podman. The EPSS score is approximately 0.0015 (0.15%), reflecting low near-term exploitation probability. The CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The issue was discovered and responsibly disclosed by Ricardo Branco (SUSE) via the oss-security mailing list (oss-security).

1. Identify a vulnerable target: Confirm the host is running Podman with an unpatched containers-common seccomp profile (RHEL 9, RHEL 10, or Fedora with Podman ≤ v6.1.3) and that SELinux is not in enforcing mode (or is disabled), since SELinux independently blocks vsock on enforcing hosts.
2. Launch a container: Start a container with dropped capabilities (e.g., --cap-drop AUDIT_WRITE) and optionally --security-opt label=disable to isolate seccomp behavior: sudo podman run --rm --cap-drop AUDIT_WRITE --security-opt label=disable <image> /bin/sh
3. Craft the bypass syscall: From within the container, invoke the socket(2) syscall with the upper 32 bits set in the address family argument. For AF_VSOCK (value 0x28), pass 0x100000028 as the domain argument. In Python: import ctypes as c; l = c.CDLL(None, use_errno=True); l.syscall(41, c.c_ulong(0x100000028), 1, 0)
4. Observe bypass: The seccomp filter evaluates 0x100000028 == 0x28 as false and allows the syscall; the kernel truncates the argument to 0x28 and creates the AF_VSOCK socket (return value ≥ 0 indicates success).
5. Exploit access: Use the opened AF_VSOCK socket for vsock-based communication with the hypervisor or host, or use the NETLINK_AUDIT socket to read audit log data, depending on the attacker's objective (GitHub Issue #1248, oss-security).

• Process Behavior: Unexpected socket(2) syscalls from container processes with argument values containing non-zero upper 32 bits (e.g., 0x100000028 for AF_VSOCK or 0x100000011 for NETLINK_AUDIT); these would appear in strace or auditd syscall logs.
• Network: Unexpected AF_VSOCK socket connections originating from container processes; vsock traffic between a container and the hypervisor/host on non-standard channels.
• Logs: Audit log entries (/var/log/audit/audit.log) showing SYSCALL records for socket with unusual a0 values (high-bit-set 64-bit integers) from container PIDs; absence of a seccomp SECCOMP audit event (type=SECCOMP) for these calls indicates the deny rule was not triggered.
• File System: Presence of seccomp profile files (seccomp.json) that use SCMP_CMP_EQ (plain equality) rather than SCMP_CMP_MASKED_EQ for AF_VSOCK or NETLINK_AUDIT deny rules — indicating an unpatched profile.

Update containers-common and Podman to patched versions that replace plain SCMP_CMP_EQ comparisons with SCMP_CMP_MASKED_EQ for AF_VSOCK and NETLINK_AUDIT deny rules in the default seccomp profile (fix merged in GitHub PR #1249). As an interim workaround, Red Hat recommends enforcing SELinux in enforcing mode, which independently blocks vsock access via the LSM even when the seccomp rule is bypassed; additionally, do not rely on the unfixed seccomp denies and consider shipping custom SCMP_CMP_MASKED_EQ profile updates (Red Hat Advisory). More broadly, prefer allowlist-based seccomp policies over denylists for syscall argument filtering, as allowlists inherently prevent unexpected upper-bit payloads (oss-security).

Ricardo Branco (SUSE), the discoverer, published a detailed oss-security disclosure on October 27, 2026, noting that the bypass pattern affects multiple projects beyond Podman — including containerd, systemd, and QEMU — and submitted documentation patches to the libseccomp C, Go, and Rust bindings (oss-security). The systemd project was noted as the most significantly affected, with RestrictNamespaces= bypass having particularly critical implications. Red Hat acknowledged the report and credited Branco in their advisory (Red Hat Advisory). The fix was reviewed and merged into container-libs within one day of the issue being filed, reflecting prompt upstream response (GitHub PR #1249).