CVE-2026-123876 · Runtime
NO FIX YET
The default seccomp profile shipped with Podman through containers-common has deny rules for AF_VSOCK and NETLINK_AUDIT sockets that compare arguments without masking. Because the kernel truncates those arguments to 32 bits, setting the upper bits can slip past the rules and reach the blocked socket types.
first public Nov 6, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams that run containers with Podman and rely on the default seccomp profile to limit container access to VSOCK and audit netlink sockets. Hosts running containers with custom seccomp profiles or no seccomp profile are not affected by this default profile flaw. Teams that do not use Podman can skip it.
Not affected if custom-seccomp-profile, no-podman
Who cares containers-common, linux, podman, self-hosted
rpm -q containers-common or dpkg -l containers-commonpodman --versionpodman info or the default profile at /usr/share/containers/seccomp.jsonNo fix yet, per the sources.
A flaw was found in the default seccomp profile used by Podman via containers-common. Deny rules for AF_VSOCK and NETLINK_AUDIT compared socket arguments with unmasked 64-bit equality. Because the kernel truncates those int arguments to 32 bits, setting upper bits can bypass the deny rules.
This page as .md · .json · CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.