opencontainers/runc v1.4.4

runc v1.4.4 -- "Never again is what you swore the time before."

on GitHub

This is the fourth patch release of the 1.4.z series of runc. It
includes a fix for a high-severity vulnerability (CVE-2026-119101)
affecting users who checkpoint and restore containers, a workaround for
a Linux kernel bug causing random runc crashes when using cgroup v2, and
other fixes. Users are encouraged to update.

Security

This release includes a fix for the following high-severity security issue:

• CVE-2026-119101 allowed a malicious image, using crafted symlinks in
  its rootfs, to confuse the way runc names external mounts for CRIU, and so
  make runc restore bind-mount an arbitrary host directory into the restored
  container, read-write. Only users who both checkpoint and later restore
  containers running untrusted images are affected (checkpoint/restore
  requires root, so rootless runc is not affected). The same issue was found
  in crun (CVE-2026-115520); CRIU itself is fixed in CVE-2026-119614.

  In addition, runc restore no longer makes read-only bind mounts writable,
  even temporarily, while preparing the container mounts.

Added

• runc version and runc features now provide version information about
  libpathrs when runc is built with the libpathrs build tag. (#5291, #5328)

Changed

• For users making use of the libpathrs build tag, runc now depends on
  libpathrs v0.2.5 or later, and attempting to build with older versions will
  cause compilation errors. (#5291, #5333)
• Switched to opencontainers/cgroups v0.1.0, which no longer uses the
  high-level cilium/ebpf API to manage cgroup v2 device rules. As a result,
  the runc binary shrunk by about 1 MiB (7.5%) on amd64. (#5403, #5583)
• Updated builds to Go 1.26. (#5413, #5583)
• Updated github.com/moby/sys/capability to v0.5.0. (#5598, #5599)
• Various CI improvements. (#5383, #5395, #5401, #5408, #5279, #5613)

Fixed

• Worked around a Linux kernel bug (present since kernel v6.17, fixed in v7.2)
  which caused the kernel to write past the end of the structure
  provided by userspace (runc). This resulted in memory corruption inside runc
  (manifesting as random crashes) when configuring device rules on cgroup v2
  systems. (#5403, #5583)
• runc exec --cgroup (and the equivalent libcontainer Process.SubCgroupPaths
  API) no longer accepts a sub-cgroup path that escapes the container's cgroup
  into a sibling cgroup sharing the same name prefix. Note that using
  --cgroup requires the same privileges as running runc exec itself, so
  this is a correctness rather than a security fix. (#5403, #5583)
• Fixed a missing O_CLOEXEC when opening the cgroup v2 directory to set up
  device rules. (#5403, #5583)
• Running a container which does not have its own mount namespace no longer
  changes the propagation of host's / and of the parent mount of the
  container rootfs (they were made private or slave). (#5537, #5582)
• Since runc 1.3.0, the org.opencontainers.runc.version annotation included
  in runc features contained an extraneous \n, possibly causing issues with
  tools that parse the output. It is now properly stripped. (#5329, #5330,
  #5331, #5335, #5336)
• On Ubuntu Focal (20.04), the maskPaths optimisation added in runc 1.4.3
  failed, as mounting tmpfs with the nr_inodes=1 option is rejected there
  due to a downstream kernel patch. We now fall back to nr_inodes=2 if the
  operation fails. (#5348, #5353, #5356, #5358, #5360)

Static Linking Notices

The runc binaries distributed with this release are statically linked with
the following GNU LGPL-2.1 licensed libraries, with runc acting
as a "work that uses the Library":

• libseccomp

The versions of these libraries were not modified from their upstream versions,
but in order to comply with their corresponding licenses, we have attached the
complete source code for those libraries which (when combined with the attached
runc source code) may be used to exercise your rights under their respective
licenses.

However, we strongly suggest that you make use of your distribution's packages
or download them from the authoritative upstream sources, especially since
these libraries are related to the security of your containers.

Thanks to the following contributors who made this release possible:

• Akihiro Suda akihiro.suda.cz@hco.ntt.co.jp
• Aleksa Sarai cyphar@cyphar.com
• Kir Kolyshkin kolyshkin@gmail.com
• Li Fu Bang lifubang@acmcoder.com

Signed-off-by: Kir Kolyshkin kolyshkin@gmail.com