opencontainers/runc v1.5.3

runc v1.5.3 -- "Let me hear you make decisions without your television."

on GitHub

This is the third patch release in the 1.5.z release series of runc. It
includes a fix for a high-severity vulnerability (CVE-2026-119101)
affecting users who checkpoint and restore containers, as well as a few
other fixes. Users are encouraged to update.

Security

This release includes a fix for the following high-severity security issue:

• CVE-2026-119101 allowed a malicious image, using crafted symlinks in
  its rootfs, to confuse the way runc names external mounts for CRIU, and so
  make runc restore bind-mount an arbitrary host directory into the restored
  container, read-write. Only users who both checkpoint and later restore
  containers running untrusted images are affected (checkpoint/restore
  requires root, so rootless runc is not affected). The same issue was found
  in crun (CVE-2026-115520); CRIU itself is fixed in CVE-2026-119614.

  In addition, runc restore no longer makes read-only bind mounts writable,
  even temporarily, while preparing the container mounts.

Fixed

• Running a container which does not have its own mount namespace no longer
  changes the propagation of host's / and of the parent mount of the
  container rootfs (they were made private or slave). (#5537, #5581)
• When making the container rootfs read-only (root.readonly), runc no longer
  clears the nosuid, nodev, noexec and nosymfollow flags of the rootfs
  mount (this only happened when not using a user namespace). (#5588, #5601)
• The defaults mount option is no longer passed to the kernel as
  filesystem-specific mount data, which made mounting filesystems that do not
  accept it (such as tmpfs) fail. (#5500, #5520, #5602)

Changed

• Updated github.com/moby/sys/capability to v0.5.0. (#5598, #5600)
• Various CI improvements. (#5481, #5482, #5488, #5574, #5586, #5590, #5609,
  #5615)

Static Linking Notices

The runc binaries distributed with this release are statically linked with
the following GNU LGPL-2.1 licensed libraries, with runc acting
as a "work that uses the Library":

• libseccomp

Similarly, the runc binaries distributed with this release are also
statically linked with the following MPLv2 licensed libraries,
with runc acting as a "Larger Work":

• libpathrs

The versions of these libraries were not modified from their upstream versions,
but in order to comply with their corresponding licenses, we have attached the
complete source code for those libraries which (when combined with the attached
runc source code) may be used to exercise your rights under their respective
licenses.

However, we strongly suggest that you make use of your distribution's packages
or download them from the authoritative upstream sources, especially since
these libraries are related to the security of your containers.

Thanks to the following contributors who made this release possible:

• Kir Kolyshkin kolyshkin@gmail.com
• Li Fu Bang lifubang@acmcoder.com
• Lucas Sotomayor sotomayorlucas@pm.me

Signed-off-by: Kir Kolyshkin kolyshkin@gmail.com