PT-2026-5316 · Unknown · Kata Containers

Champ-Goblem · Published 2026-01-29 · Updated 2026-03-15 · CVE-2026-24054

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions Kata Containers versions prior to 3.26.0

Description Kata Containers is an open source project that implements lightweight Virtual Machines (VMs) functioning like containers. A flaw exists where, when processing a malformed or empty container image, containerd resorts to bind-mounting an empty snapshotter directory for the container rootfs. This causes the Kata runtime to identify the rootfs as a block device, triggering hotplugging of the underlying device within the guest. This can result in filesystem-level errors on the host, including double inode allocation, potentially leading to the host's block device being mounted as read-only. The issue can cause denial of service and a risk of system integrity compromise.

Recommendations Versions prior to 3.26.0 should be updated to version 3.26.0 or later.

Exploit

Fix

Improper Check for Exceptional Conditions

Weakness Enumeration

CWE-754

Related Identifiers

AZL-75770

CVE-2026-24054

GHSA-5FC8-GG7W-3G5C

OESA-2026-1433

OESA-2026-1434

OESA-2026-1435

OESA-2026-1436

OESA-2026-1437

OESA-2026-1599

Affected Products

Kata Containers

References · 24

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24054.json · Exploit
• https://github.com/containerd/containerd/blob/d939b6af5f8536c2cae85e919e7c40070557df0e/plugins/snapshots/overlay/overlay.go#L564-L581 · Patch
• https://github.com/kata-containers/kata-containers/security/advisories/GHSA-5fc8-gg7w-3g5c · Vendor Advisory
• https://github.com/kata-containers/kata-containers/commit/20ca4d2d79aa5bf63aa1254f08915da84f19e92a · Patch
• https://github.com/kata-containers/kata-containers/blob/c7d0c270ee7dfaa6d978e6e07b99dabdaf2b9fda/src/runtime/virtcontainers/container.go#L1616-L1623 · Patch
• https://github.com/kata-containers/kata-containers/blob/a164693e1afead84cd01d5bc3575e2cbfe64ce35/src/runtime/virtcontainers/container.go#L1122-L1126 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-24054 · Security Note
• https://osv.dev/vulnerability/OESA-2026-1437 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-1433 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-1434 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-75770 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-1435 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-24054 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-1599 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-1436 · Vendor Advisory