Security update for runc
This update for runc fixes the following issues: - CVE-2026-41579: runc allows a malicious image with a /dev symlink to trigger limited host filesystem integrity violations (bsc#1268275). Changes for runc: - update to 1.3.6: * Various integration test improvements. (#5222, #5237, #5226, #5229, #5239, #5249, #5269, #5287, #5295, #5304) * When masking directories with `maskPaths`, runc will now re- use a single `tmpfs` instance (which is not writeable) to reduce the number `tmpfs` superblocks that need to be reaped when containers die (in particular, Kubernetes applies masks to per-CPU sysfs directories which get expensive quickly). - update to 1.3.5 * Recursive atime-related mount flags (rrelatime et al.) are now applied properly. (#5115, #5098) * PR #4757 caused a regression that resulted in spurious cannot start a container that has stopped errors when running runc create and has thus been reverted. (#5158, #5153, #5151, #4645, #4757) * Updated builds to Go 1.25, libseccomp v2.6.0. (#5111, #5053) * Minor signing keyring updates. (#5146, #5139, #5144, #5148)
02 / AFFECTED SOFTWARE
Affected packages
03 / CONNECTIONS
Connected vulnerabilities
04 / EVIDENCE
Source records
This update for runc fixes the following issues: - CVE-2026-41579: runc allows a malicious image with a /dev symlink to trigger limited host filesystem integrity violations (bsc#1268275). Changes for runc: - update to 1.3.6: * Various integration test improvements. (#5222, #5237, #5226, #5229, #5239, #5249, #5269, #5287, #5295, #5304) * When masking directories with `maskPaths`, runc will now re- use a single `tmpfs` instance (which is not writeable) to reduce the number `tmpfs` superblocks that need to be reaped when containers die (in particular, Kubernetes applies masks to per-CPU sysfs directories which get expensive quickly). - update to 1.3.5 * Recursive atime-related mount flags (rrelatime et al.) are now applied properly. (#5115, #5098) * PR #4757 caused a regression that resulted in spurious cannot start a container that has stopped errors when running runc create and has thus been reverted. (#5158, #5153, #5151, #4645, #4757) * Updated builds to Go 1.25, libseccomp v2.6.0. (#5111, #5053) * Minor signing keyring updates. (#5146, #5139, #5144, #5148)
05 / REFERENCES