CVE-2026-47243 Kata guest escape: runtime-rs guest-root to host-root escape via virtiofs

Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines VMs that perform like containers. Prior to 3.31.0, the runtime-rs standalone virtio-fs path is vulnerable to a guest-root to host-root escape. In this configuration, Kata runs the host...

CVE-2026-47243 Kata guest escape: runtime-rs guest-root to host-root escape via virtiofs

Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines VMs that perform like containers. Prior to 3.31.0, the runtime-rs standalone virtio-fs path is vulnerable to a guest-root to host-root escape. In this configuration, Kata runs the host...

CVE-2026-53381

A flaw was found in the virtiofs component of the Linux kernel. A use-after-free UAF vulnerability exists during submount unmount operations. This occurs because the iput function, called from fusereleaseend, can attempt to access a super block that has already been destroyed. This can lead to a...

virtiofs: fix UAF on submount umount

...

SUSE CVE-2026-53381

In the Linux kernel, the following vulnerability has been resolved: virtiofs: fix UAF on submount umount iput called from fusereleaseend can Oops if the super block has already been destroyed. Normally this is prevented by waiting for numwaiting to go down to zero before commencing with super blo...

CVE-2026-53381

In the Linux kernel, the following vulnerability has been resolved: virtiofs: fix UAF on submount umount iput called from fusereleaseend can Oops if the super block has already been destroyed. Normally this is prevented by waiting for numwaiting to go down to zero before commencing with super blo...

CVE-2026-53381 virtiofs: fix UAF on submount umount

In the Linux kernel, the following vulnerability has been resolved: virtiofs: fix UAF on submount umount iput called from fusereleaseend can Oops if the super block has already been destroyed. Normally this is prevented by waiting for numwaiting to go down to zero before commencing with super blo...

EUVD-2026-45503

In the Linux kernel, the following vulnerability has been resolved: virtiofs: fix UAF on submount umount iput called from fusereleaseend can Oops if the super block has already been destroyed. Normally this is prevented by waiting for numwaiting to go down to zero before commencing with super blo...

CVE-2026-53381

In the Linux kernel, the following vulnerability has been resolved: virtiofs: fix UAF on submount umount iput called from fusereleaseend can Oops if the super block has already been destroyed. Normally this is prevented by waiting for numwaiting to go down to zero before commencing with super blo...

CVE-2026-53381

The CVE-2026-53381 issue affects the Linux kernel’s virtiofs path for submount umount. The root cause is a use-after-free (UAF) in iput() invoked from fuse_release_end() when the superblock has already been destroyed; the existing safeguard (wait for num_waiting to drop to zero) only covered the ...

CVE-2026-53381

In the Linux kernel, the following vulnerability has been resolved: virtiofs: fix UAF on submount umount iput called from fusereleaseend can Oops if the super block has already been destroyed. Normally this is prevented by waiting for numwaiting to go down to zero before commencing with super blo...

CVE-2026-53381 virtiofs: fix UAF on submount umount

In the Linux kernel, the following vulnerability has been resolved: virtiofs: fix UAF on submount umount iput called from fusereleaseend can Oops if the super block has already been destroyed. Normally this is prevented by waiting for numwaiting to go down to zero before commencing with super blo...

Linux Distros Unpatched Vulnerability : CVE-2026-53381

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - virtiofs: fix UAF on submount umount iput called from fusereleaseend can Oops if the super block has already been destroyed. Normally this is prevented by waiti...

PT-2026-61086

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A Use-After-Free UAF issue exists in the virtiofs component during submount umount operations. The problem occurs when iput is called from fuse release end, which can lead to a system...

PYSEC-2026-299 BoxLite: Permission Bypass Allows Modification of Read-Only Files

Summary Boxlite is a sandbox service that allows users to create lightweight virtual machines Boxes and launch OCI containers within them to run untrusted code. One of the core security features claimed by Boxlite is the ability to mount host directories in read-only mode readonly=True into the V...

GO-2026-5042 Kata guest escape: runtime-rs guest-root to host-root escape via virtiofs in github.com/kata-containers/kata-containers

Kata guest escape: runtime-rs guest-root to host-root escape via virtiofs in github.com/kata-containers/kata-containers...

Kata guest escape: runtime-rs guest-root to host-root escape via virtiofs

Summary In the runtime-rs standalone virtio-fs path, verified here with QEMU and verified with Cloud Hypervisor too, Kata Containers runs host virtiofsd as root with: --sandbox none --seccomp none If an attacker has root-equivalent execution inside the Kata guest VM, they can send raw FUSE reques...

CLSA-2026-1779375889 kernel: Fix of 95 CVEs

perf/x86/intel/uncore: Fix die ID init and look up bugs CVE-2026-43344 - x86/apic: Disable x2apic on resume if the kernel expects so CVE-2026-43363 - drm/amdgpu: Fix use-after-free race in VM acquire CVE-2026-43370 - dm: remove fake timeout to avoid leak request CVE-2026-43314 - md/bitmap: fix...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: fsdax: The infinite loop in daxiomaprw has been fixed. I encountered an infinite loop and a warning message when executing the tail command in virtiofs. Warning: CPU: 10; PID: 964; Location: fs/iomap/iter.c:34,...

Astra Linux – Vulnerability in Linux

In the Linux kernel, the following vulnerability has been resolved: virtiofs: fixed a memory leak in virtiofsprobe When the same tag was accidentally passed twice to qemu, kmemleak ended up reporting a memory leak in virtiofs. Additionally, looking at the log, I noticed the following error which...