CVE-2026-24054

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-24054", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-20T22:30:11.778Z", "datePublished": "2026-01-29T17:16:56.418Z", "dateUpdated": "2026-01-29T21:24:54.166Z"}, "containers": {"cna": {"title": "Kata Containers Runtime: Host block device can be hotplugged to the VM if the container image is malformed or contains no layers", "problemTypes": [{"descriptions": [{"cweId": "CWE-754", "lang": "en", "description": "CWE-754: Improper Check for Unusual or Exceptional Conditions", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "HIGH", "subAvailabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H/E:P", "version": "4.0"}}], "references": [{"name": "https://github.com/kata-containers/kata-containers/security/advisories/GHSA-5fc8-gg7w-3g5c", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/kata-containers/kata-containers/security/advisories/GHSA-5fc8-gg7w-3g5c"}, {"name": "https://github.com/kata-containers/kata-containers/commit/20ca4d2d79aa5bf63aa1254f08915da84f19e92a", "tags": ["x_refsource_MISC"], "url": "https://github.com/kata-containers/kata-containers/commit/20ca4d2d79aa5bf63aa1254f08915da84f19e92a"}, {"name": "https://github.com/containerd/containerd/blob/d939b6af5f8536c2cae85e919e7c40070557df0e/plugins/snapshots/overlay/overlay.go#L564-L581", "tags": ["x_refsource_MISC"], "url": "https://github.com/containerd/containerd/blob/d939b6af5f8536c2cae85e919e7c40070557df0e/plugins/snapshots/overlay/overlay.go#L564-L581"}, {"name": "https://github.com/kata-containers/kata-containers/blob/a164693e1afead84cd01d5bc3575e2cbfe64ce35/src/runtime/virtcontainers/container.go#L1122-L1126", "tags": ["x_refsource_MISC"], "url": "https://github.com/kata-containers/kata-containers/blob/a164693e1afead84cd01d5bc3575e2cbfe64ce35/src/runtime/virtcontainers/container.go#L1122-L1126"}, {"name": "https://github.com/kata-containers/kata-containers/blob/c7d0c270ee7dfaa6d978e6e07b99dabdaf2b9fda/src/runtime/virtcontainers/container.go#L1616-L1623", "tags": ["x_refsource_MISC"], "url": "https://github.com/kata-containers/kata-containers/blob/c7d0c270ee7dfaa6d978e6e07b99dabdaf2b9fda/src/runtime/virtcontainers/container.go#L1616-L1623"}], "affected": [{"vendor": "kata-containers", "product": "kata-containers", "versions": [{"version": "< 3.26.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-29T17:16:56.418Z"}, "descriptions": [{"lang": "en", "value": "Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines (VMs) that perform like containers. In versions prior to 3.26.0, when a container image is malformed or contains no layers, containerd falls back to bind-mounting an empty snapshotter directory for the container rootfs. When the Kata runtime attempts to mount the container rootfs, the bind mount causes the rootfs to be detected as a block device, leading to the underlying device being hotplugged to the guest. This can cause filesystem-level errors on the host due to double inode allocation, and may lead to the host's block device being mounted as read-only. Version 3.26.0 contains a patch for the issue."}], "source": {"advisory": "GHSA-5fc8-gg7w-3g5c", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-29T21:24:41.276960Z", "id": "CVE-2026-24054", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-29T21:24:54.166Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-24054", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-29T21:24:41.276960Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-29T21:24:47.129Z"}}], "cna": {"title": "Kata Containers Runtime: Host block device can be hotplugged to the VM if the container image is malformed or contains no layers", "source": {"advisory": "GHSA-5fc8-gg7w-3g5c", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H/E:P", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}}], "affected": [{"vendor": "kata-containers", "product": "kata-containers", "versions": [{"status": "affected", "version": "< 3.26.0"}]}], "references": [{"url": "https://github.com/kata-containers/kata-containers/security/advisories/GHSA-5fc8-gg7w-3g5c", "name": "https://github.com/kata-containers/kata-containers/security/advisories/GHSA-5fc8-gg7w-3g5c", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/kata-containers/kata-containers/commit/20ca4d2d79aa5bf63aa1254f08915da84f19e92a", "name": "https://github.com/kata-containers/kata-containers/commit/20ca4d2d79aa5bf63aa1254f08915da84f19e92a", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/containerd/containerd/blob/d939b6af5f8536c2cae85e919e7c40070557df0e/plugins/snapshots/overlay/overlay.go#L564-L581", "name": "https://github.com/containerd/containerd/blob/d939b6af5f8536c2cae85e919e7c40070557df0e/plugins/snapshots/overlay/overlay.go#L564-L581", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/kata-containers/kata-containers/blob/a164693e1afead84cd01d5bc3575e2cbfe64ce35/src/runtime/virtcontainers/container.go#L1122-L1126", "name": "https://github.com/kata-containers/kata-containers/blob/a164693e1afead84cd01d5bc3575e2cbfe64ce35/src/runtime/virtcontainers/container.go#L1122-L1126", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/kata-containers/kata-containers/blob/c7d0c270ee7dfaa6d978e6e07b99dabdaf2b9fda/src/runtime/virtcontainers/container.go#L1616-L1623", "name": "https://github.com/kata-containers/kata-containers/blob/c7d0c270ee7dfaa6d978e6e07b99dabdaf2b9fda/src/runtime/virtcontainers/container.go#L1616-L1623", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines (VMs) that perform like containers. In versions prior to 3.26.0, when a container image is malformed or contains no layers, containerd falls back to bind-mounting an empty snapshotter directory for the container rootfs. When the Kata runtime attempts to mount the container rootfs, the bind mount causes the rootfs to be detected as a block device, leading to the underlying device being hotplugged to the guest. This can cause filesystem-level errors on the host due to double inode allocation, and may lead to the host's block device being mounted as read-only. Version 3.26.0 contains a patch for the issue."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-754", "description": "CWE-754: Improper Check for Unusual or Exceptional Conditions"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-29T17:16:56.418Z"}}}, "cveMetadata": {"cveId": "CVE-2026-24054", "state": "PUBLISHED", "dateUpdated": "2026-01-29T21:24:54.166Z", "dateReserved": "2026-01-20T22:30:11.778Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-01-29T17:16:56.418Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "kata-containers", "vendor": "kata-containers", "versions": [{"status": "affected", "version": "< 3.26.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:katacontainers:kata_containers:*:*:*:*:*:*:*:*", "matchCriteriaId": "83FC9E90-1A39-4F26-8F79-3324F03EF0DD", "versionEndExcluding": "3.26.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines (VMs) that perform like containers. In versions prior to 3.26.0, when a container image is malformed or contains no layers, containerd falls back to bind-mounting an empty snapshotter directory for the container rootfs. When the Kata runtime attempts to mount the container rootfs, the bind mount causes the rootfs to be detected as a block device, leading to the underlying device being hotplugged to the guest. This can cause filesystem-level errors on the host due to double inode allocation, and may lead to the host's block device being mounted as read-only. Version 3.26.0 contains a patch for the issue."}, {"lang": "es", "value": "Kata Containers es un proyecto de c\u00f3digo abierto centrado en una implementaci\u00f3n est\u00e1ndar de M\u00e1quinas Virtuales (VMs) ligeras que se comportan como contenedores. En versiones anteriores a la 3.26.0, cuando una imagen de contenedor est\u00e1 malformada o no contiene capas, containerd recurre a montar mediante bind-mount un directorio snapshotter vac\u00edo para el rootfs del contenedor. Cuando el tiempo de ejecuci\u00f3n de Kata intenta montar el rootfs del contenedor, el bind mount provoca que el rootfs sea detectado como un dispositivo de bloque, lo que lleva a que el dispositivo subyacente sea conectado en caliente (hotplugged) al invitado. Esto puede causar errores a nivel de sistema de archivos en el host debido a la doble asignaci\u00f3n de inodos, y puede llevar a que el dispositivo de bloque del host sea montado como de solo lectura. La versi\u00f3n 3.26.0 contiene un parche para el problema."}], "id": "CVE-2026-24054", "lastModified": "2026-06-17T10:22:31.847", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 10.0, "baseSeverity": "CRITICAL", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.8, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-24054", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-29T21:24:41.276960Z", "version": "2.0.3"}}]}, "published": "2026-01-29T18:16:15.270", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/containerd/containerd/blob/d939b6af5f8536c2cae85e919e7c40070557df0e/plugins/snapshots/overlay/overlay.go#L564-L581"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/kata-containers/kata-containers/blob/a164693e1afead84cd01d5bc3575e2cbfe64ce35/src/runtime/virtcontainers/container.go#L1122-L1126"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/kata-containers/kata-containers/blob/c7d0c270ee7dfaa6d978e6e07b99dabdaf2b9fda/src/runtime/virtcontainers/container.go#L1616-L1623"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/kata-containers/kata-containers/commit/20ca4d2d79aa5bf63aa1254f08915da84f19e92a"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Patch", "Vendor Advisory"], "url": "https://github.com/kata-containers/kata-containers/security/advisories/GHSA-5fc8-gg7w-3g5c"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-754"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "kata-containers: Kata Containers: Denial of Service and filesystem errors due to malformed container image processing", "id": "2435336", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2435336"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.3", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H", "status": "draft"}, "cwe": "CWE-1287", "details": ["No description is available for this CVE."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-24054", "package_state": [{"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Under investigation", "package_name": "kata-containers", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Under investigation", "package_name": "rhcos", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-01-29T17:16:56Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-24054\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-24054\nhttps://github.com/containerd/containerd/blob/d939b6af5f8536c2cae85e919e7c40070557df0e/plugins/snapshots/overlay/overlay.go#L564-L581\nhttps://github.com/kata-containers/kata-containers/blob/a164693e1afead84cd01d5bc3575e2cbfe64ce35/src/runtime/virtcontainers/container.go#L1122-L1126\nhttps://github.com/kata-containers/kata-containers/blob/c7d0c270ee7dfaa6d978e6e07b99dabdaf2b9fda/src/runtime/virtcontainers/container.go#L1616-L1623\nhttps://github.com/kata-containers/kata-containers/commit/20ca4d2d79aa5bf63aa1254f08915da84f19e92a\nhttps://github.com/kata-containers/kata-containers/security/advisories/GHSA-5fc8-gg7w-3g5c"], "threat_severity": "Moderate"}

{"analysis": {"en": {"generated_at": "2026-04-18T01:24:15.898163+00:00", "value": {"mitigation_remediation": ["Upgrade Kata Containers to version 3.26.0 or later", "Ensure that all container images contain valid layers before starting a container", "Configure containerd or Kata to reject or quarantine malformed images and avoid bind\u2011mounting empty snapshot directories", "Restrict image registry access and monitor for unexpected image changes", "If an upgrade cannot be performed immediately, de\u2011mount any hot\u2011plugged block devices and repair inode allocation or restore from backup"], "summary": {"action": "Patch", "impact": "Host filesystem corruption and potential read\u2011only state of block devices"}, "threat_synthesis": {"affected_systems": "This vulnerability affects all versions of Kata Containers prior to 3.26.0. The product is provided by Kata Containers Ltd. and is identified in the CNA as kata-containers:kata-containers. Users running any earlier release are susceptible.", "description_and_impact": "When Kata Containers processes a container image that is malformed or has no layers, the on\u2011disk image store is fall\u2011backed to a bind\u2011mounted empty directory. The runtime interprets this bind mount as a block device. The host\u2019s underlying block device is then hot\u2011plugged into the guest VM. In such a scenario the host filesystem can suffer from double inode allocation errors, and the block device may become mounted read\u2011only, compromising file integrity and availability. The flaw maps to CWE\u20111287 and CWE\u2011754, which reflect misuse of block device semantics and inconsistent block device handling.", "risk_and_exploitability": "The CVSS score is 8.8, indicating high severity. EPSS predicts a very low but non\u2011zero exploitation probability (<1%) and the issue has not been listed in the CISA KEV catalog. The likely attack path involves an attacker being able to supply a malformed container image to the host, either by compromising a container registry or by obtaining write access to the host\u2019s container image store. Successful exploitation would trigger the erroneous hot\u2011plug of the host block device into the VM, leading to filesystem corruption and a read\u2011only state that may impact host operations."}}}}, "created": "2026-01-30T08:43:19.421537+00:00", "updated": "2026-04-18T01:30:16.042104+00:00", "vendors": ["katacontainers", "katacontainers$PRODUCT$kata-containers"]}