Security Flaw in Containerd's Checkpoint Restore Functionality
CVE-2026-95837
7.8HIGH
What is CVE-2026-95837?
The vulnerability in containerd affects the CRI CreateContainer checkpoint restore functionality, where the CRIU tool improperly restores process security states from checkpoint data. This leads to potential security risks, as an attacker could manipulate a container utilizing a crafted checkpoint to restore unwanted credentials and capabilities. Consequently, processes may be executed with escalated privileges, bypassing intended security controls including seccomp filters. This flaw is relevant for all versions from 2.1.0 up to 2.3.4 and is not an issue for systems that do not utilize CRI checkpoint restore.
Affected Version(s)
containerd >= 2.1.0, < 2.2.7 < 2.1.0, 2.2.7
containerd >= 2.3.0, < 2.3.4 < 2.3.0, 2.3.4