CVE-2026-24054highCWE-754

CVE-2026-24054: high-severity vulnerability in kata-containers

Kata Containers Runtime: Host block device can be hotplugged to the VM if the container image is malformed or contains no layers

Published

Follow this CVE+ Monitor kata-containers

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.8epss 0.5%
Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines (VMs) that perform like containers. In versions prior to 3.26.0, when a container image is malformed or contains no layers, containerd falls back to bind-mounting an empty snapshotter directory for the container rootfs. When the Kata runtime attempts to mount the container rootfs, the bind mount causes the rootfs to be detected as a block device, leading to the underlying device being hotplugged to the guest. This can cause filesystem-level errors on the host due to double inode allocation, and may lead to the host's block device being mounted as read-only. Version 3.26.0 contains a patch for the issue.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H/E:P
Affected products
kata-containers · kata-containers
Related CVEs — kata-containers

In the same product, most dangerous first.

CVE-2026-44210MEDIUMKata Containers have VM Escape via virtiofsd Argument Injection through Default-Enabled Pod AnnotationsEPSS 0.6%CVE-2026-50540CRITICALKata Containers: Config Path Annotation Arbitrary File LoadingEPSS 0.4%CVE-2026-41326HIGHKata Containers: CopyFile Policy Subversion via SymlinksEPSS 0.3%CVE-2025-58354MEDIUMKata Containers coco-tdx malicious host can circumvent initdata verificationEPSS 0.3%CVE-2026-24834CRITICALKata Container to Guest micro VM privilege escalationEPSS 0.2%CVE-2026-47243CRITICALKata guest escape: runtime-rs guest-root to host-root escape via virtiofsEPSS 0.2%