CVE-2026-123876

EUVD-2026-118387
A flaw was found in the default seccomp profile used by Podman via containers-common. Deny rules for AF_VSOCK and NETLINK_AUDIT compared socket arguments with unmasked 64-bit equality. Because the kernel truncates those int arguments to 32 bits, setting upper bits can bypass the deny rules.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
4.4 MEDIUM
LOCAL
LOW
LOW
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Common Weakness Enumeration
References
https://access.redhat.com/security/cve/CVE-2026-123876
https://bugzilla.redhat.com/show_bug.cgi?id=2566536
https://github.com/podman-container-tools/container-libs/issues/1248
https://github.com/podman-container-tools/container-libs/pull/1249
https://www.openwall.com/lists/oss-security/2026/10/27/3