---
id: "CVE-2026-123876"
page: "https://infrastack.ai/live/CVE-2026-123876"
kind: "vulnerability"
aliases: ["CVE-2026-123876"]
title: "Podman: default seccomp profile socket deny rules bypassable via upper bits"
severity: "medium"
cvss: 4.4
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["containers-common", "linux", "podman", "runtime", "self-hosted"]
not_affected_if: ["custom-seccomp-profile", "no-podman"]
published_at: "2026-11-06T18:18:05+00:00"
first_seen_at: "2026-11-06T18:44:09+00:00"
updated_at: "2026-11-06T18:45:26+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123876", "first_seen_at": "2026-11-06T18:44:09+00:00"}]
exploit_sources: []
---

# Podman: default seccomp profile socket deny rules bypassable via upper bits

Link for people: https://infrastack.ai/live/CVE-2026-123876 (this .md is for agents)

The default seccomp profile shipped with Podman through containers-common has deny rules for AF_VSOCK and NETLINK_AUDIT sockets that compare arguments without masking. Because the kernel truncates those arguments to 32 bits, setting the upper bits can slip past the rules and reach the blocked socket types.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed containers-common package version with `rpm -q containers-common` or `dpkg -l containers-common`
- Check the Podman version with `podman --version`
- Review the seccomp profile in use with `podman info` or the default profile at `/usr/share/containers/seccomp.json`

## Timeline

- 2026-11-06T18:44:09+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123876

## From the sources

A flaw was found in the default seccomp profile used by Podman via containers-common. Deny rules for AF_VSOCK and NETLINK_AUDIT compared socket arguments with unmasked 64-bit equality. Because the kernel truncates those int arguments to 32 bits, setting upper bits can bypass the deny rules.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_