{"id":"CVE-2026-123876","kind":"vulnerability","aliases":["CVE-2026-123876"],"related":[],"title":"Podman: default seccomp profile socket deny rules bypassable via upper bits","description":"A flaw was found in the default seccomp profile used by Podman via containers-common. Deny rules for AF_VSOCK and NETLINK_AUDIT compared socket arguments with unmasked 64-bit equality. Because the kernel truncates those int arguments to 32 bits, setting upper bits can bypass the deny rules.","summary":"The default seccomp profile shipped with Podman through containers-common has deny rules for AF_VSOCK and NETLINK_AUDIT sockets that compare arguments without masking. Because the kernel truncates those arguments to 32 bits, setting the upper bits can slip past the rules and reach the blocked socket types.","severity":"medium","cvss":4.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["containers-common","linux","podman","runtime","self-hosted"],"not_affected_if":["custom-seccomp-profile","no-podman"],"how_to_check":"- Check the installed containers-common package version with `rpm -q containers-common` or `dpkg -l containers-common`\n- Check the Podman version with `podman --version`\n- Review the seccomp profile in use with `podman info` or the default profile at `/usr/share/containers/seccomp.json`","fix":null,"status":"open","published_at":"2026-11-06T18:18:05+00:00","first_seen_at":"2026-11-06T18:44:09+00:00","triaged_at":"2026-11-06T18:45:26+00:00","updated_at":"2026-11-06T18:45:26+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-11-06T18:45:26Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Podman: default seccomp profile socket deny rules bypassable via upper bits","impact":"medium","summary":"The default seccomp profile shipped with Podman through containers-common has deny rules for AF_VSOCK and NETLINK_AUDIT sockets that compare arguments without masking. Because the kernel truncates those arguments to 32 bits, setting the upper bits can slip past the rules and reach the blocked socket types.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["podman","containers-common","linux","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"container escapes seccomp socket restrictions and reaches blocked socket types","analyst_note":"Sources give only the NVD description; confirm affected and fixed containers-common versions from the Podman or Red Hat advisory.","how_to_check":"- Check the installed containers-common package version with `rpm -q containers-common` or `dpkg -l containers-common`\n- Check the Podman version with `podman --version`\n- Review the seccomp profile in use with `podman info` or the default profile at `/usr/share/containers/seccomp.json`","plain_action":"","needs_analyst":true,"not_affected_if":["custom-seccomp-profile","no-podman"],"who_is_affected":"Teams that run containers with Podman and rely on the default seccomp profile to limit container access to VSOCK and audit netlink sockets. Hosts running containers with custom seccomp profiles or no seccomp profile are not affected by this default profile flaw. Teams that do not use Podman can skip it.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000727,"input_tokens":4222,"output_tokens":609,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-123876':14A,17A '-2026':13A,16A '32':60B,117C '64':106C 'af':42B,96C 'argument':50B,58B,103C,115C 'audit':46B,100C 'bit':11A,61B,65B,107C,118C,121C 'block':74B 'bypass':8A,123C 'common':20B,37B,92C 'compar':49B,101C 'contain':19B,36B,91C 'containers-common':18B,35B,90C 'cve':12A,15A 'default':2A,28B,83C 'deni':6A,39B,93C,125C 'equal':108C 'flaw':78C 'found':80C 'host':26B 'int':114C 'kernel':55B,111C 'linux':21B 'mask':52B 'netlink':45B,99C 'past':68B 'podman':1A,22B,33B,88C 'profil':4A,30B,85C 'reach':72B 'rule':7A,40B,70B,94C,126C 'runtim':23B 'seccomp':3A,29B,84C 'self':25B 'self-host':24B 'set':62B,119C 'ship':31B 'slip':67B 'socket':5A,47B,75B,102C 'truncat':56B,112C 'type':76B 'unmask':105C 'upper':10A,64B,120C 'use':86C 'via':9A,89C 'vsock':43B,97C 'without':51B","nicknames":[],"mitigations":[],"who_affected":"Teams that run containers with Podman and rely on the default seccomp profile to limit container access to VSOCK and audit netlink sockets. Hosts running containers with custom seccomp profiles or no seccomp profile are not affected by this default profile flaw. Teams that do not use Podman can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["containerscommon","linux","medium","podman","runtime","selfhosted"],"campaign_type":null,"search_a":"'-123876':14A,17A '-2026':13A,16A 'bit':11A 'bypass':8A 'cve':12A,15A 'default':2A 'deni':6A 'podman':1A 'profil':4A 'rule':7A 'seccomp':3A 'socket':5A 'upper':10A 'via':9A","search_b":"'32':60B 'af':42B 'argument':50B,58B 'audit':46B 'bit':61B,65B 'block':74B 'common':20B,37B 'compar':49B 'contain':19B,36B 'containers-common':18B,35B 'default':28B 'deni':39B 'host':26B 'kernel':55B 'linux':21B 'mask':52B 'netlink':45B 'past':68B 'podman':22B,33B 'profil':30B 'reach':72B 'rule':40B,70B 'runtim':23B 'seccomp':29B 'self':25B 'self-host':24B 'set':62B 'ship':31B 'slip':67B 'socket':47B,75B 'truncat':56B 'type':76B 'upper':64B 'vsock':43B 'without':51B","search_c":"'32':117C '64':106C 'af':96C 'argument':103C,115C 'audit':100C 'bit':107C,118C,121C 'bypass':123C 'common':92C 'compar':101C 'contain':91C 'containers-common':90C 'default':83C 'deni':93C,125C 'equal':108C 'flaw':78C 'found':80C 'int':114C 'kernel':111C 'netlink':99C 'podman':88C 'profil':85C 'rule':94C,126C 'seccomp':84C 'set':119C 'socket':102C 'truncat':112C 'unmask':105C 'upper':120C 'use':86C 'via':89C 'vsock':97C","first_public_at":"2026-11-06T18:18:05+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123876","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123876","severity":null,"published_at":"2026-11-06T18:18:05+00:00","modified_at":"2026-11-06T18:18:05+00:00","first_seen_at":"2026-11-06T18:44:09+00:00","fetched_at":"2026-11-06T18:44:09+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}