CVE-2026-84042

CVE-2026-84042 is a privilege-management flaw (CWE-269) in crun, the OCI container runtime used by Podman and related container tooling. When crun is built with libkrun and a container is started rootful with passt networking enabled (krun.use_passt), crun can execute an attacker-controlled payload taken from the container image with host root privileges; the CVSS scope change (S:C) reflects this break from the container boundary to the host. An attacker who can supply or influence the container image, or start such a container on the host, gains full root code execution on the host itself with high impact to confidentiality, integrity, and availability. Only crun versions 1.29 and later are affected, since this is a regression introduced in crun 1.29, and only deployments combining a libkrun-enabled build with rootful passt networking are exposed. There is currently no evidence of exploitation in the wild and no public proof-of-concept; the advisory was issued by Red Hat as CNA.

What to do: Upgrade crun to a fixed release as soon as one is published upstream or via your distro (any release correcting the 1.29 regression); until then, avoid running crun 1.29+ in the affected configuration. As interim mitigation, do not start containers rootful with passt networking under libkrun (disable krun.use_passt), or use a crun build compiled without libkrun or an alternative OCI runtime. Audit hosts with crun --version to confirm the version and whether the build includes libkrun, check for containers launched with krun.use_passt, and restrict who can supply or run images on such hosts.