{"id":"CVE-2026-123876","title":"Podman: containers-common: containers-common: default seccomp af_vsock/netlink_audit deny rules bypassable via 32-bit truncation","summary":"A flaw was found in the default seccomp profile used by Podman via containers-common. Deny rules for AF_VSOCK and NETLINK_AUDIT compared socket arguments with unmasked 64-bit equality. Because the kernel truncates those int arguments to …","severity":"medium","cvss":4.4,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","cvssSource":"cna","cwe":["CWE-184"],"vendor":"Red Hat","product":"containers-common","affected":["containers-common (all versions)","container-tools:rhel8/containers-common (all versions)","containers-common (all versions)","containers-common","podman (all versions)","skopeo","containers-common (all versions)","openshift/ose-rhel-coreos-8 (all versions)","openshift/ose-rhel-coreos-9 (all versions)","openshift/ose-rhel-coreos-9 (all versions)"],"published":"2026-11-06","updated":"2026-11-06","sourceUpdated":"2026-11-06T17:38:41.186Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-123876","references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-123876"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2566536","label":"RHBZ#2566536"},{"url":"https://github.com/podman-container-tools/container-libs/issues/1248"},{"url":"https://github.com/podman-container-tools/container-libs/pull/1249"},{"url":"https://www.openwall.com/lists/oss-security/2026/10/27/3"}],"tags":["cve.org"],"ingestedAt":"2026-11-06T18:00:12.510Z","slug":"CVE-2026-123876","body":"## Overview\n\nA flaw was found in the default seccomp profile used by Podman via containers-common. Deny rules for AF_VSOCK and NETLINK_AUDIT compared socket arguments with unmasked 64-bit equality. Because the kernel truncates those int arguments to 32 bits, setting upper bits can bypass the deny rules.\n\n## Affected\n\n- `containers-common (all versions)`\n- `container-tools:rhel8/containers-common (all versions)`\n- `containers-common (all versions)`\n- `containers-common`\n- `podman (all versions)`\n- `skopeo`\n- `containers-common (all versions)`\n- `openshift/ose-rhel-coreos-8 (all versions)`\n- `openshift/ose-rhel-coreos-9 (all versions)`\n- `openshift/ose-rhel-coreos-9 (all versions)`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n### Workarounds\n\nEnforcing SELinux may still deny vsock; do not rely on the unfixed seccomp denies; ship SCMP_CMP_MASKED_EQ profile updates.","depth":"sunlit","depthScore":24,"depthScoreParts":{"impact":24.2,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}