tag
Container-Escape
Linux AF_UNIX GC vs MSG_PEEK Use-After-Free Container Escape (CVE-2026-53361)
CVE-2026-53361 is a use-after-free in the Linux AFUNIX socket garbage collector triggered via a MSGPEEK race. The GC reclaims in-flight sockets forming unreachable reference cycles, but a concurrent MSGPEEK can take a reference the GC census never counts. The…
Docker — CopyEscape: Container-to-Host Escape via docker cp Race Condition (CVE-2026-17106)
CVE-2026-17106, nicknamed CopyEscape, is a race condition in Docker's docker cp command that allows a malicious running container to escape and write arbitrary files on the Docker host. The vulnerability exists in how Docker's archive producer walks the…
Linux Kernel rtmutex Priority-Inheritance Stack-UAF — "GhostLock" (CVE-2026-43499, Nebula Security weaponized variant)
Nebula Security independently discovered and weaponized a use-after-free in the Linux kernel's rtmutex priority-inheritance cleanup logic, naming it "GhostLock." They describe it as a stack-UAF reachable via ordinary threading/futex calls from any…
OpenLearnX Unauthenticated RCE via Container Volume Mount (CVE-2026-41900)
OpenLearnX's /api/compiler/execute endpoint runs untrusted user-submitted code inside a sibling Docker container, but the blueprint carries no authentication decorator, so any unauthenticated request can trigger it. The pre-patch executeincontainer() function…
Linux BPF Verifier Scalar-Forking Soundness Bug to Container Escape — CVE-2026-31413
The Linux BPF verifier's maybeforkscalars() forks verifier state when it sees an ARSH followed by AND/OR with a constant. The forked ("pushed") path is generated via pushstack(env, env->insnidx + 1, ...), which skips the ALU instruction on that path and…
Kubernetes `runAsNonRoot` Bypass via UID Integer Overflow (CVE-2026-46680)
Kubernetes' securityContext.runAsNonRoot: true admission check is meant to prevent Pods from running as UID 0 (root). This PoC demonstrates that a crafted container image with a numeric UID value that overflows the integer type used internally by the…
Gitea act_runner container.options Host Namespace Escape
Gitea's actrunner allows workflow YAML to append Docker options via jobs.<job>.container.options. When the runner configuration disables privileged mode, actrunner forces Privileged back to false and sanitizes bind mounts, but it preserves every other Docker…
Docker cp Copy-Out Destination Escape via Symlink Race
docker cp copy-out operations are vulnerable to a time-of-check/time-of-use race: the daemon walks the container's source path with filepath.WalkDir and builds a tar stream, but if a container process changes a directory entry (e.g., swaps it for a symlink)…
Linux vsock Use-After-Free VM Escape (CVE-2025-21756)
CVE-2025-21756 is a use-after-free vulnerability in the Linux kernel's vsock (virtual socket) subsystem. An attacker with code execution inside a virtual machine can exploit this bug to escape the VM boundary and gain root-level code execution on the…