Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
AlmaLinux Toolbox can let attackers gain admin rights
published 1 year ago
Summary
The Toolbox package on AlmaLinux, which provides container command‑line environments, contains a flaw in the NVIDIA container component that could allow a malicious user to increase their privileges on the host system. This could let an attacker run code with administrative rights. Update Toolbox to the latest version as soon as possible to close the problem.
What to do
- Update almalinux toolbox to version 0.2-1.el10_0.
- Update almalinux toolbox-tests to version 0.2-1.el10_0.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| AlmaLinux:10 | almalinux | toolbox |
< 0.2-1.el10_0 Fix: upgrade to 0.2-1.el10_0
|
| AlmaLinux:10 | almalinux | toolbox-tests |
< 0.2-1.el10_0 Fix: upgrade to 0.2-1.el10_0
|
Original advisory text
Important: toolbox security update
Toolbox is a tool for Linux operating systems, which allows the use of containerized command line environments. It is built on top of Podman and other standard container technologies from OCI.
Security Fix(es):
* nvidia-container-toolkit: Privilege Escalation via Hook Initialization in NVIDIA Container Toolkit (CVE-2025-23266)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Security Fix(es):
* nvidia-container-toolkit: Privilege Escalation via Hook Initialization in NVIDIA Container Toolkit (CVE-2025-23266)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
References
- https://access.redhat.com/errata/RHSA-2025:13674 Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2025-23266 Third Party Advisory
- https://bugzilla.redhat.com/2381794 Third Party Advisory
- https://errata.almalinux.org/10/ALSA-2025-13674.html Vendor Advisory
Timeline
Published12 Aug 2025
Updated29 Oct 2026
First seen29 Oct 2026
Sources
ALSA-2025:13674 · OSV
Track software like this
Free during beta