Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.8
rocky crun can run container code as host root
published today
Summary
The crun component used in Rocky Linux can mistakenly run container tasks with full system (root) privileges, giving the container the same power as the host operating system. This could let a compromised container take control of the whole server. Update crun to the latest version and enable the required container SELinux policy to protect the system.
What to do
- Update rocky crun to version 0:1.29.1-1.el9.
- Update rocky crun-debuginfo to version 0:1.29.1-1.el9.
- Update rocky crun-debugsource to version 0:1.29.1-1.el9.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Rocky Linux:9 | rocky | crun |
< 0:1.29.1-1.el9 Fix: upgrade to 0:1.29.1-1.el9
|
| Rocky Linux:9 | rocky | crun-debuginfo |
< 0:1.29.1-1.el9 Fix: upgrade to 0:1.29.1-1.el9
|
| Rocky Linux:9 | rocky | crun-debugsource |
< 0:1.29.1-1.el9 Fix: upgrade to 0:1.29.1-1.el9
|
Original advisory text
Important: crun security, bug fix, and enhancement update
crun is a OCI runtime
Security Fix(es):
* crun: crun: rootful krun with passt executes container payload as host root (CVE-2026-84042)
Bug Fix(es) and Enhancement(s):
* crun should require container-selinux (JIRA:Rocky Linux-169227)
* update to the latest upstream release (JIRA:Rocky Linux-185741)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Rocky Linux 9 Release Notes linked from the References section.
Security Fix(es):
* crun: crun: rootful krun with passt executes container payload as host root (CVE-2026-84042)
Bug Fix(es) and Enhancement(s):
* crun should require container-selinux (JIRA:Rocky Linux-169227)
* update to the latest upstream release (JIRA:Rocky Linux-185741)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Rocky Linux 9 Release Notes linked from the References section.
References
- https://errata.rockylinux.org/RLSA-2026:97561 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2531222 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2026:97561 Vendor Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker full control (estimated)
Timeline
Published13 Nov 2026
Updated13 Nov 2026
First seen13 Nov 2026
Sources
RLSA-2026:97561 · OSV
Track software like this
Free during beta