Medium severity4.4NVD Advisory· Published Nov 6, 2026· Updated Nov 6, 2026

CVE-2026-123876

Description

A flaw was found in the default seccomp profile used by Podman via containers-common. Deny rules for AF_VSOCK and NETLINK_AUDIT compared socket arguments with unmasked 64-bit equality. Because the kernel truncates those int arguments to 32 bits, setting upper bits can bypass the deny rules.

Affected products

Containers Common/containers-commonllm-create
Podman/container-libsllm-create

Patches

Vulnerability mechanics

References

access.redhat.com/security/cve/CVE-2026-123876nvd
bugzilla.redhat.com/show_bug.cginvd
github.com/podman-container-tools/container-libs/issues/1248nvd
github.com/podman-container-tools/container-libs/pull/1249nvd
www.openwall.com/lists/oss-security/2026/10/27/3nvd

News mentions

No linked articles in our index yet.

cvss	0.286
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000