opencontainers/runc v1.3.7

runc v1.3.7 -- "Your optimistic eyes seem like paradise to someone like me."

on GitHub

This is the seventh (and probably the last) patch release of the 1.3.z series
of runc. It includes a fix for a high-severity vulnerability (CVE-2026-119101)
affecting users who checkpoint and restore containers, as well as a few other
fixes. Users are encouraged to update.

Security

This release includes a fix for the following high-severity security issue:

• CVE-2026-119101 allowed a malicious image, using crafted symlinks in
  its rootfs, to confuse the way runc names external mounts for CRIU, and so
  make runc restore bind-mount an arbitrary host directory into the restored
  container, read-write. Only users who both checkpoint and later restore
  containers running untrusted images are affected (checkpoint/restore
  requires root, so rootless runc is not affected). The same issue was found
  in crun (CVE-2026-115520); CRIU itself is fixed in CVE-2026-119614.

  In addition, runc restore no longer makes read-only bind mounts writable,
  even temporarily, while preparing the container mounts.

Fixed

• The org.opencontainers.runc.version annotation reported by runc features
  no longer contains a trailing newline (a regression in runc 1.3.0), and now
  includes EXTRA_VERSION. (#5329, #5331, #5335, #5337)

Changed

• Updated builds to Go 1.26. (#5413, #5409)
• Various CI fixes. (#5339, #5401, #5427, #5279, #5409)

Static Linking Notices

The runc binaries distributed with this release are statically linked with
the following GNU LGPL-2.1 licensed libraries, with runc acting
as a "work that uses the Library":

• libseccomp

The versions of these libraries were not modified from their upstream versions,
but in order to comply with their corresponding licenses, we have attached the
complete source code for those libraries which (when combined with the attached
runc source code) may be used to exercise your rights under their respective
licenses.

However, we strongly suggest that you make use of your distribution's packages
or download them from the authoritative upstream sources, especially since
these libraries are related to the security of your containers.

Thanks to the following contributors who made this release possible:

• Akihiro Suda akihiro.suda.cz@hco.ntt.co.jp
• Aleksa Sarai cyphar@cyphar.com
• Kir Kolyshkin kolyshkin@gmail.com

Signed-off-by: Kir Kolyshkin kolyshkin@gmail.com