{"id":"CVE-2026-123876","published":"2026-11-06T18:18:05.410","lastModified":"2026-11-10T20:19:03.850","description":"A flaw was found in the default seccomp profile used by Podman via containers-common. Deny rules for AF_VSOCK and NETLINK_AUDIT compared socket arguments with unmasked 64-bit equality. Because the kernel truncates those int arguments to 32 bits, setting upper bits can bypass the deny rules.","cvssScore":4.4,"cvssSeverity":"MEDIUM","cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","cwes":["CWE-184"],"vendors":[],"products":[],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-123876","tags":[]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2566536","tags":[]},{"url":"https://github.com/podman-container-tools/container-libs/issues/1248","tags":[]},{"url":"https://github.com/podman-container-tools/container-libs/pull/1249","tags":[]},{"url":"https://www.openwall.com/lists/oss-security/2026/10/27/3","tags":[]},{"url":"https://github.com/podman-container-tools/container-libs/issues/1248","tags":[]}],"exploitRefs":[{"url":"https://github.com/podman-container-tools/container-libs/issues/1248","tags":[]},{"url":"https://github.com/podman-container-tools/container-libs/pull/1249","tags":[]},{"url":"https://github.com/podman-container-tools/container-libs/issues/1248","tags":[]}],"hasPoc":true,"ai":null}