PT-2026-5316 · Unknown · Kata Containers

Champ-Goblem · Publicado 2026-01-29 · Atualizado 2026-03-15 · CVE-2026-24054

Positive Technologies (AI Summary)

CVSS v3.1

10

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions Kata Containers versions prior to 3.26.0

Description Kata Containers is an open source project that implements lightweight Virtual Machines (VMs) functioning like containers. A flaw exists where, when processing a malformed or empty container image, containerd resorts to bind-mounting an empty snapshotter directory for the container rootfs. This causes the Kata runtime to identify the rootfs as a block device, triggering hotplugging of the underlying device within the guest. This can result in filesystem-level errors on the host, including double inode allocation, potentially leading to the host's block device being mounted as read-only. The issue can cause denial of service and a risk of system integrity compromise.

Recommendations Versions prior to 3.26.0 should be updated to version 3.26.0 or later.

Exploit

Correção

Improper Check for Exceptional Conditions

Enumeração de Fraquezas

CWE-754

Identificadores relacionados

AZL-75770

CVE-2026-24054

GHSA-5FC8-GG7W-3G5C

OESA-2026-1433

OESA-2026-1434

OESA-2026-1435

OESA-2026-1436

OESA-2026-1437

OESA-2026-1599

Produtos afetados

Kata Containers

Referências · 24

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24054.json · Exploit
• https://github.com/containerd/containerd/blob/d939b6af5f8536c2cae85e919e7c40070557df0e/plugins/snapshots/overlay/overlay.go#L564-L581 · Correção
• https://github.com/kata-containers/kata-containers/security/advisories/GHSA-5fc8-gg7w-3g5c · Aviso do Fabricante
• https://github.com/kata-containers/kata-containers/commit/20ca4d2d79aa5bf63aa1254f08915da84f19e92a · Correção
• https://github.com/kata-containers/kata-containers/blob/c7d0c270ee7dfaa6d978e6e07b99dabdaf2b9fda/src/runtime/virtcontainers/container.go#L1616-L1623 · Correção
• https://github.com/kata-containers/kata-containers/blob/a164693e1afead84cd01d5bc3575e2cbfe64ce35/src/runtime/virtcontainers/container.go#L1122-L1126 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2026-24054 · Nota de Segurança
• https://t.me/k8security/1756 · Publicação no Telegram
• https://twitter.com/CVEnew/status/2016934795419259108 · Publicação no Twitter
• https://twitter.com/VulmonFeeds/status/2016955293238731165 · Publicação no Twitter
• https://openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1433 · Nota
• https://openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1599 · Nota
• https://osv.dev/vulnerability/OESA-2026-1437 · Aviso do Fabricante
• https://openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1437 · Nota
• https://osv.dev/vulnerability/OESA-2026-1433 · Aviso do Fabricante