Vulnerability in Kata Containers Affects Open Source Virtual Machine Operations

CVE-2026-24054

What is CVE-2026-24054?

Kata Containers, an open-source implementation of lightweight virtual machines, contains a vulnerability in versions prior to 3.26.0. This issue arises when a malformed container image leads containerd to bind-mount an empty snapshotter directory as the container's root file system (rootfs). This erroneous bind mount results in the rootfs being misidentified as a block device, which can trigger the hotplugging of the underlying device to the guest system. Consequently, this may result in critical filesystem-level errors on the host system, such as double inode allocations and potentially force the host's block device into a read-only state. The vulnerability is addressed in version 3.26.0 with a critical patch.

References