CVE-2026-47766: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-47766 is a UNIX symbolic link (symlink) following vulnerability in crun, an open-source OCI Container Runtime written in C. Prior to version 1.28, crun's default device setup opens the container rootfs /dev directory without the O_NOFOLLOW flag, allowing a crafted OCI bundle to redirect device node and symlink creation outside the container rootfs. The vulnerability was disclosed on May 27, 2026, and affects all crun versions before 1.28. It carries a CVSS v4.0 base score of 5.1 (Medium) (GitHub Advisory, Feedly).

The root cause is classified as CWE-61 (UNIX Symbolic Link Following). In src/libcrun/linux.c, the function create_missing_devs() opens the /dev directory using openat(rootfsfd, "dev", O_CLOEXEC | O_PATH | O_DIRECTORY) without O_NOFOLLOW, meaning if rootfs/dev is a symlink, the kernel follows it to an arbitrary target outside the container rootfs. The resulting file descriptor is then used for mknodat(), symlinkat(), and forced unlinkat()/symlinkat() calls, creating device nodes and symlinks at the attacker-controlled symlink target. The same vulnerable open pattern also exists in src/libcrun/handlers/krun.c before KVM/SEV/Nitro device creation. Exploitation requires a locally crafted OCI bundle with rootfs/dev set as a symlink and no /dev mount in the bundle configuration (GitHub Advisory).

Successful exploitation allows an attacker to create fixed device nodes and symlinks at arbitrary locations outside the container rootfs on the host filesystem, and to overwrite existing files — specifically, any pre-existing file named ptmx in the symlink target directory is forcibly replaced with a ptmx -> pts/ptmx symlink. This constitutes an integrity impact on the host filesystem. The vulnerability is limited to local, rootful crun execution contexts and does not directly expose confidential data or affect availability, but file replacement outside the container boundary could be leveraged as part of a broader attack chain (GitHub Advisory, Feedly).

No public exploit code or in-the-wild exploitation has been reported for CVE-2026-47766. The NVD SSVC assessment indicates exploitation is "none" and the vulnerability is not automatable. The EPSS score is approximately 0.024%, reflecting a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Feedly).

1. Craft a malicious OCI bundle: Create an OCI bundle where rootfs/dev is a symbolic link pointing to a target directory outside the container rootfs (e.g., /tmp/attacker-controlled/).
2. Omit /dev mount: Ensure the bundle's config.json does not include a bind mount for /dev, so crun proceeds to create default device nodes itself.
3. Run crun in rootful mode: Execute crun run or crun replay with the crafted bundle as root, triggering create_missing_devs() in src/libcrun/linux.c.
4. Observe symlink traversal: crun opens rootfs/dev without O_NOFOLLOW, follows the symlink to the attacker-specified target, and creates device nodes (null, zero, full, etc.) and symlinks (including ptmx -> pts/ptmx) at that location.
5. File overwrite: If a file named ptmx exists in the target directory, it is forcibly replaced by crun's ptmx -> pts/ptmx symlink before crun returns a failure code (GitHub Advisory).

• File System: Unexpected device node files (e.g., null, zero, full, random, urandom) or symlinks (e.g., ptmx -> pts/ptmx, stdin, stdout, stderr) appearing in directories outside any container rootfs, particularly in world-writable or user-controlled directories.
• File System: A pre-existing file named ptmx in a non-standard location replaced by a symlink pointing to pts/ptmx.
• Logs: crun process logs showing failure after device node creation, combined with unexpected file creation events in host directories (detectable via auditd or inotify on sensitive paths).
• Process: crun or crun replay invocations running as root with OCI bundles where rootfs/dev resolves to a path outside the bundle directory (GitHub Advisory).

Upgrade crun to version 1.28 or later, which fixes the issue by opening rootfs /dev using safe_openat (with O_NOFOLLOW semantics) before creating default or handler-specific devices, preventing symlink traversal outside the container rootfs. No configuration-based workaround is documented; upgrading is the recommended and only confirmed remediation. SUSE has also issued a security update (SUSE-SU-2026:22247-1) for affected distributions (crun Release 1.28, GitHub Advisory).

The vulnerability was reported by security researcher "mosskappa" and credited in the GitHub advisory. The fix was published by crun maintainer Giuseppe Scrivano (giuseppe) alongside crun 1.28 on May 27, 2026. SUSE issued a distribution-level security update, and the issue was discussed on the oss-security mailing list. Community reaction has been limited given the low severity rating (GitHub Advisory, oss-sec).