{"id":"CVE-2026-111436","kind":"vulnerability","aliases":["CVE-2026-111436"],"related":[],"title":"iSulad: memory leak in mount spec handling lets a daemon crash","description":"Missing release of memory after effective lifetime vulnerability in openEuler iSulad on Linux.\n\nThis vulnerability is associated with program file src/daemon/modules/spec/specs_mount.c.\n\n\n\nThis issue affects iSulad: through 2.1.6.\n\n\n\nThe memory leak vulnerability causes the iSulad daemon to be triggered frequently, exhausting the host machine's memory and ultimately leading to an OOM crash of the daemon, resulting in a denial of service (DoS).","summary":"iSulad, a container daemon from openEuler, leaks memory in its mount specification code (specs_mount.c). Repeated triggering exhausts host memory until the daemon runs out of memory and crashes, causing denial of service.","severity":"medium","cvss":4.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["containers","infrastructure","isulad","linux","openeuler"],"not_affected_if":["not-using-isulad"],"how_to_check":"- Check the installed iSulad version against `2.1.6` and below\n- Look for the `isulad` daemon process and its memory growth over time with `ps -o rss,cmd -C isulad`","fix":null,"status":"open","published_at":"2026-11-12T04:17:17+00:00","first_seen_at":"2026-11-12T04:47:08+00:00","triaged_at":"2026-11-12T04:48:00+00:00","updated_at":"2026-11-12T04:48:00+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-12T04:48:00Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"iSulad: memory leak in mount spec handling lets a daemon crash","impact":"low","summary":"iSulad, a container daemon from openEuler, leaks memory in its mount specification code (specs_mount.c). Repeated triggering exhausts host memory until the daemon runs out of memory and crashes, causing denial of service.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["isulad","openeuler","linux","containers"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Daemon crashes from memory exhaustion, denying container service","analyst_note":"Confirm the fixed version and the request path that reaches specs_mount.c from the NVD or openEuler advisory; sources give only 'through 2.1.6'.","how_to_check":"- Check the installed iSulad version against `2.1.6` and below\n- Look for the `isulad` daemon process and its memory growth over time with `ps -o rss,cmd -C isulad`","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["not-using-isulad"],"who_is_affected":"Hosts running the iSulad container daemon through version 2.1.6 are affected. The leak is triggered by requests that go through the mount spec path, so hosts that do not run iSulad can skip it. The sources do not say which request types reach the leaking code.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000726,"input_tokens":4608,"output_tokens":530,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-111436':14A,17A '-2026':13A,16A '2.1.6':82C 'affect':79C 'associ':72C 'caus':52B,87C 'code':35B 'contain':18B,25B 'crash':11A,51B,107C 'cve':12A,15A 'daemon':10A,26B,45B,90C,110C 'denial':53B,114C 'dos':117C 'effect':61C 'exhaust':40B,95C 'file':75C 'frequent':94C 'handl':7A 'host':41B,97C 'infrastructur':19B 'issu':78C 'isulad':1A,20B,23B,66C,80C,89C 'lead':103C 'leak':3A,29B,85C 'let':8A 'lifetim':62C 'linux':21B,68C 'machin':98C 'memori':2A,30B,42B,49B,59C,84C,100C 'miss':56C 'mount':5A,33B 'mount.c':37B 'oom':106C 'openeul':22B,28B,65C 'program':74C 'releas':57C 'repeat':38B 'result':111C 'run':46B 'servic':55B,116C 'spec':6A,36B 'specif':34B 'src/daemon/modules/spec/specs_mount.c':76C 'trigger':39B,93C 'ultim':102C 'vulner':63C,70C,86C","nicknames":[],"mitigations":[],"who_affected":"Hosts running the iSulad container daemon through version 2.1.6 are affected. The leak is triggered by requests that go through the mount spec path, so hosts that do not run iSulad can skip it. The sources do not say which request types reach the leaking code.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["containers","infrastructure","isulad","linux","medium","openeuler"],"campaign_type":null,"search_a":"'-111436':14A,17A '-2026':13A,16A 'crash':11A 'cve':12A,15A 'daemon':10A 'handl':7A 'isulad':1A 'leak':3A 'let':8A 'memori':2A 'mount':5A 'spec':6A","search_b":"'caus':52B 'code':35B 'contain':18B,25B 'crash':51B 'daemon':26B,45B 'denial':53B 'exhaust':40B 'host':41B 'infrastructur':19B 'isulad':20B,23B 'leak':29B 'linux':21B 'memori':30B,42B,49B 'mount':33B 'mount.c':37B 'openeul':22B,28B 'repeat':38B 'run':46B 'servic':55B 'spec':36B 'specif':34B 'trigger':39B","search_c":"'2.1.6':82C 'affect':79C 'associ':72C 'caus':87C 'crash':107C 'daemon':90C,110C 'denial':114C 'dos':117C 'effect':61C 'exhaust':95C 'file':75C 'frequent':94C 'host':97C 'issu':78C 'isulad':66C,80C,89C 'lead':103C 'leak':85C 'lifetim':62C 'linux':68C 'machin':98C 'memori':59C,84C,100C 'miss':56C 'oom':106C 'openeul':65C 'program':74C 'releas':57C 'result':111C 'servic':116C 'src/daemon/modules/spec/specs_mount.c':76C 'trigger':93C 'ultim':102C 'vulner':63C,70C,86C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T04:17:17+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","cvss_by":"securities@openeuler.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111436","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111436","severity":null,"published_at":"2026-11-12T04:17:17+00:00","modified_at":"2026-11-12T04:17:17+00:00","first_seen_at":"2026-11-12T04:47:08+00:00","fetched_at":"2026-11-12T04:47:08+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}