CVE-2026-123876 PUBLISHED

Podman: containers-common: containers-common: default seccomp af_vsock/netlink_audit deny rules bypassable via 32-bit truncation

Assigner: redhat
Reserved: 06.11.2026 Published: 06.11.2026 Updated: 06.11.2026

A flaw was found in the default seccomp profile used by Podman via containers-common. Deny rules for AF_VSOCK and NETLINK_AUDIT compared socket arguments with unmasked 64-bit equality. Because the kernel truncates those int arguments to 32 bits, setting upper bits can bypass the deny rules.

Metrics

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
CVSS Score: 4.4

Product Status

Vendor Red Hat
Product Red Hat Enterprise Linux 10
Versions Default: affected
Vendor Red Hat
Product Red Hat Enterprise Linux 8
Versions Default: unaffected
Vendor Red Hat
Product Red Hat Enterprise Linux 9
Versions Default: affected
Vendor Red Hat
Product Red Hat Hardened Images
Versions Default: unaffected
Vendor Red Hat
Product Red Hat Hardened Images
Versions Default: affected
Vendor Red Hat
Product Red Hat Hardened Images
Versions Default: unaffected
Vendor Red Hat
Product Red Hat OpenShift Container Platform 4
Versions Default: unaffected
Vendor Red Hat
Product Red Hat OpenShift Container Platform 4
Versions Default: affected
Vendor Red Hat
Product Red Hat OpenShift Container Platform 4
Versions Default: affected
Vendor Red Hat
Product Red Hat OpenShift Container Platform 5
Versions Default: affected

Workarounds

Enforcing SELinux may still deny vsock; do not rely on the unfixed seccomp denies; ship SCMP_CMP_MASKED_EQ profile updates.

Credits

  • Red Hat would like to thank Ricardo Branco (SUSE) for reporting this issue.

References

Problem Types

  • Incomplete List of Disallowed Inputs CWE