# CVE-2026-41579: runc: Malicious image with /dev symlink can trigger limited host filesystem integrity violations

CVE-2026-41579 is fixed in 4 products on 1 platform, first by DEBIAN-CVE-2026-41579, released July 1, 2026. It is not reported as exploited. Patch Radar priority: Routine.

- Web page: https://patchblox.com/security/cve/CVE-2026-41579
- Priority: Routine
- CVSS: 3.3 (Low)
- EPSS: 0.0019
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Jul 1, 2026
- Weakness: UNIX Symbolic Link (Symlink) Following
- Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41579

## Description

runc is a CLI tool for spawning and running containers according to the OCI specification. In versions prior to 1.3.6, 1.4.0-rc.1, 1.4.0-rc.12, 1.5.0-rc.1, and 1.5.0-rc.1, when setting up the container rootfs, setupPtmx and setupDevSymlinks call os.Remove and os.Symlink with a filepath.Join string which allow an image with /dev as a symlink to trick runc into deleting files called ptmx on the host or creating a hardcoded set of symlinks with specific names and targets in an arbitrary pre-existing host directory. This issue is not exploitable under Docker, because Docker creates a top-level read-only layer that masks any malicious /dev symlink present in the container image — unlike some other Linux container tooling, whose higher-level runtimes built on runc remain exposed to exploitation via a malicious image. This issue has been fixed in versions 1.3.6, 1.4.3 and 1.5.0.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | govulncheck-vulndb opensuse-leap 16.0 | 0.0.20260723T184607-160000.1.1 | [OPENSUSE-SU-2026:21483-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-21483-1.md) | Jul 30, 2026 |
| Linux | runc Debian 14 | 1.3.6+ds1-1 | [DEBIAN-CVE-2026-41579](https://patchblox.com/security/data/fix/linux/debian-cve-2026-41579.md) | Jul 1, 2026 |
| Linux | runc amzn 2023 | 1.3.6-1.amzn2023.0.1 | [ALAS2023-2026-2138](https://patchblox.com/security/data/fix/linux/alas2023-2026-2138.md) | Sep 14, 2026 |
| Linux | runc opensuse-leap 16.0 | 1.3.6-160000.1.1 | [OPENSUSE-SU-2026:21431-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-21431-1.md) | Jul 23, 2026 |
| Linux | runc sles 15.6 | 1.3.6-150000.101.1 | [SUSE-SU-2026:3433-2](https://patchblox.com/security/data/fix/linux/suse-su-2026-3433-2.md) | Aug 10, 2026 |
| Linux | runc sles 15.7 | 1.3.6-150000.101.1 | [SUSE-SU-2026:3433-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-3433-1.md) | Jul 30, 2026 |
| Linux | runc sles 16.0 | 1.3.6-160000.1.1 | [SUSE-SU-2026:22942-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-22942-1.md) | Jul 23, 2026 |
| Linux | runc-debuginfo amzn 2023 | 1.3.6-1.amzn2023.0.1 | [ALAS2023-2026-2138](https://patchblox.com/security/data/fix/linux/alas2023-2026-2138.md) | Sep 14, 2026 |
| Linux | runc-debugsource amzn 2023 | 1.3.6-1.amzn2023.0.1 | [ALAS2023-2026-2138](https://patchblox.com/security/data/fix/linux/alas2023-2026-2138.md) | Sep 14, 2026 |

---

Data as of 2026-11-08T00:53:09Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.