AZL-101102

See a problem?
Import Source
https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-101102.json
JSON Data
https://api.osv.dev/v1/vulns/AZL-101102
Upstream
  • CVE-2026-88265
Published
2026-09-10T09:17:03Z
Modified
2026-09-20T05:32:18Z
Summary
CVE-2026-88265 affecting package crun 1.24-6
Details

A flaw was found in crun. After pivot_root, reopening /dev/null for stdio can follow a symlink and attach a host file to container stdio, then change that file's ownership. Affected versions are crun 1.29.1 and earlier. Default configurations that mount a fresh /dev are not exposed. No fixed release is available yet.

References

Affected packages

Azure Linux:3 / crun

Package

Name
crun
Purl
pkg:rpm/azure-linux/crun

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Last Affected
1.24-6

Database specific

source 
"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-101102.json"