Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

runc on Red Hat Linux: Privilege Escalation Risk

published 6 months ago

Summary

A security update is available for runc on Red Hat Linux, which addresses a potential vulnerability that could allow attackers to gain elevated privileges on the system. This update is recommended for all users running runc on Red Hat Linux to ensure the security and integrity of their system. Applying the update will help prevent unauthorized access and protect against potential data breaches.

What to do

Update redhat runc to version 4:1.2.9-1.el9_4.1.
Update redhat runc-debuginfo to version 4:1.2.9-1.el9_4.1.
Update redhat runc-debugsource to version 4:1.2.9-1.el9_4.1.

Affected software

Ecosystem	Vendor	Product	Affected versions
Red Hat:rhel_eus:9.4::appstream	redhat	runc	< 4:1.2.9-1.el9_4.1 Fix: upgrade to 4:1.2.9-1.el9_4.1
Red Hat:rhel_eus:9.4::appstream	redhat	runc-debuginfo	< 4:1.2.9-1.el9_4.1 Fix: upgrade to 4:1.2.9-1.el9_4.1
Red Hat:rhel_eus:9.4::appstream	redhat	runc-debugsource	< 4:1.2.9-1.el9_4.1 Fix: upgrade to 4:1.2.9-1.el9_4.1

Original advisory text

Red Hat Security Advisory: runc security update

References

https://access.redhat.com/errata/RHSA-2026:12031 Vendor Advisory
https://access.redhat.com/security/updates/classification/#important Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2418462 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2434432 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2437111 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2445356 Third Party Advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_12031.... Vendor Advisory
https://access.redhat.com/security/cve/CVE-2025-61726 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2025-61726 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2025-61726 Vendor Advisory
https://go.dev/cl/736712 Third Party Advisory
https://go.dev/issue/77101 Third Party Advisory
https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc Third Party Advisory
https://pkg.go.dev/vuln/GO-2026-4341 Vendor Advisory
https://access.redhat.com/security/cve/CVE-2025-61729 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2025-61729 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2025-61729 Vendor Advisory
https://go.dev/cl/725920 Third Party Advisory
https://go.dev/issue/76445 Third Party Advisory
https://groups.google.com/g/golang-announce/c/8FJoBkPddm4 Third Party Advisory
https://pkg.go.dev/vuln/GO-2025-4155 Vendor Advisory
https://access.redhat.com/security/cve/CVE-2025-68121 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2025-68121 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2025-68121 Vendor Advisory
https://go.dev/cl/737700 Third Party Advisory
https://go.dev/issue/77217 Third Party Advisory
https://groups.google.com/g/golang-announce/c/K09ubi9FQFk Third Party Advisory
https://pkg.go.dev/vuln/GO-2026-4337 Vendor Advisory
https://access.redhat.com/security/cve/CVE-2026-25679 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-25679 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-25679 Vendor Advisory
https://go.dev/cl/752180 Third Party Advisory
https://go.dev/issue/77578 Third Party Advisory
https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk Third Party Advisory
https://pkg.go.dev/vuln/GO-2026-4601 Vendor Advisory

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker partial control (estimated)

Severity

7.5 High

Timeline

Published30 Apr 2026

Updated30 Apr 2026

First seen30 Apr 2026

Sources

RHSA-2026:12031 · OSV

Track software like this

Free during beta