Loading story…
Multiple vulnerabilities were discovered in runc, the container runtime used by Docker, Kubernetes, and other platforms, that allow attackers to escape container isolation. One of the critical flaws, tracked as CVE-2025-52565, arises from insufficient validation during the bind-mounting of /dev/pts/$n to /dev/console inside containers. Attackers can exploit this race condition to redirect the mount and gain write access to protected files in the procfs, such as /proc/sysrq-trigger or /proc/sys/kernel/core_pattern, potentially leading to denial of service or container breakout. The vulnerability affects runc versions 1.0.0-rc3 through 1.2.7, 1.3.0-rc.1 through 1.3.2, and 1.4.0-rc.1 through 1.4.0-rc.2, and has been addressed in versions 1.2.8, 1.3.3, and 1.4.0-rc.3.
Exploitation of CVE-2025-52565 requires the ability to start containers with custom mount configurations, making environments that run untrusted container images or Dockerfiles particularly vulnerable. No active exploits have been reported as of the disclosure, but security researchers recommend updating to the patched runc versions and monitoring for suspicious container activity. The vulnerability is similar in concept to CVE-2025-31133 but targets a different aspect of the container initialization process, specifically the timing and validation of the /dev/console mount before security protections are fully applied.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
Subsequent reporting summarized that two of the runC flaws affected all versions and the third affected versions 1.0.0-rc3 and later, with fixes available in 1.2.8, 1.3.3, 1.4.0-rc.3, and later. Reports also highlighted mitigations such as enabling user namespaces, avoiding host-root mappings, and using rootless containers.
CVE-2025-52565 was added to public vulnerability tracking feeds as a high-severity container escape issue tied to /dev/console mount handling and related race conditions in runC. This reflected broader public indexing of the disclosed flaw.
Security vendors and media, including Sysdig and Fortinet, published analyses highlighting the newly disclosed runC flaws and their impact on Docker and Kubernetes environments. Coverage emphasized that exploitation could let attackers break container isolation, while noting no active exploitation had been reported.
GitHub security advisories were published for CVE-2025-31133, CVE-2025-52565, and CVE-2025-52881, describing container escape and denial-of-service risks in runC. The advisories identified issues including masked-path abuse, /dev/console mount races, and procfs write redirects.
The opencontainers/runc project published patched releases v1.2.8, v1.3.3, and v1.4.0-rc.3 to address three vulnerabilities: CVE-2025-31133, CVE-2025-52565, and CVE-2025-52881. The flaws could enable container escape through mount and symlink race conditions and related arbitrary-write paths.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
12 references tracked. Mallory keeps watching after this page renders.
csirt.sk
Open sourcescworld.com
Open sourcebleepingcomputer.com
Open sourcecvefeed.io
Open sourcegithub.com
Open sourcegithub.com
Open sourcegithub.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers disclosed three new `runc` vulnerabilities — `CVE-2025-31133`, `CVE-2025-52565`, and `CVE-2025-52881` — that can let attackers break container isolation and gain root access on the host systems running Docker, Kubernetes, and other platforms built on `runc`. The flaws abuse race conditions, mount manipulation, and redirected writes into `procfs`, including paths such as `/proc/sys/kernel/core_pattern` and `/proc/sysrq-trigger`, to turn container access into host-level impact. Sysdig reported that exploitation requires the ability to launch containers with custom mount configurations, making malicious or untrusted container images and Dockerfiles a likely delivery path, and said no active exploitation had been observed at disclosure. The new issues echo the earlier `CVE-2019-5736` `runC` escape, which allowed container root users to overwrite the host `runC` binary via `/proc/self/exe` and `/proc/[pid]/exe` handling and then execute code as root on the host. That earlier flaw affected Docker by default and also impacted LXC in some configurations, leading maintainers to harden `runC` by re-executing from a sealed in-memory copy created with `memfd_create()`. For the newly disclosed bugs, fixed releases are `runc` `1.2.8`, `1.3.3`, and `1.4.0-rc.3` or later, and defenders were advised to monitor for suspicious symlink creation and other attempts to target sensitive `procfs` entries from inside containers.
Jun 29, 2026
Security researchers have disclosed three critical vulnerabilities in the runC container runtime, which is widely used in platforms such as Docker and Kubernetes. The flaws, identified as CVE-2025-31133, CVE-2025-52565, and CVE-2025-52881, arise from logic and race-condition errors in runC's handling of temporary bind mounts, symbolic links, and certain write operations. Attackers can exploit these weaknesses to break container isolation, potentially gaining write access to sensitive host system files and kernel interfaces such as `/proc/sys/kernel/core_pattern` or `/proc/sysrq-trigger`, leading to full container escapes and even host-level compromise. The vulnerabilities allow attackers to abuse masked paths, console bind-mounts, and redirected writes, bypassing standard hardening and isolation controls. Exploitation requires either custom mount configurations or the use of untrusted container images, but the risk is significant for orchestrated environments like Docker and Kubernetes. Security advisories from both the runC project and the U.S. National Vulnerability Database urge immediate updates to patched versions or the application of provided patches to mitigate these threats. The vulnerabilities highlight the importance of robust container runtime security and the potential impact of logic flaws in core infrastructure components.
Jun 29, 2026
A long-standing Linux kernel flaw in SCTP Dynamic Address Reconfiguration, tracked as **CVE-2026-64564** and dubbed **SCTPhantom**, was disclosed as a deterministic use-after-free bug that can let a low-privileged local user gain **root** privileges and potentially escape from a container to the host. The vulnerability affects ASCONF handling, where a crafted sequence of `DEL-IP` operations can free an SCTP transport and later reuse the dangling pointer. Researchers said the vulnerable logic dates back to **Linux 2.6.25** and reported successful exploitation on Debian 13, Ubuntu 24.04, Rocky Linux 9, RHEL 9-family systems, OpenCloudOS, and a Linux 7.2 release candidate, including multiple tested host-root container escapes. Fixes are available in mainline commit `9b2854f86f0b` and in stable kernel releases **6.6.148**, **6.12.101**, **6.18.42**, **7.1.6**, and **7.2-rc5**. Discussion on the oss-sec mailing list noted that practical exposure varies by distribution: on Rocky Linux 9 and RHEL 9-family systems, SCTP is typically not installed by default because it resides in the `kernel-modules-extra` package and is blacklisted for autoload, meaning administrators would generally need to explicitly install and load the module for the bug to be reachable. Defenders were urged to patch affected kernels or disable SCTP where it is not required.
Aug 12, 2026