Most recent entries from all

CLEANSTART-2026-ON51112 — Security fix for CVE-2025-27612 applied in: nvidia-device-plugin 0.19.2-r1

2026-10-03T20:13:29.460911+00:00

Affected: CleanStart: nvidia-device-plugin

Security vulnerability affects the nvidia-device-plugin package. This issue is resolved in later releases. See references for vulnerability details.

EUVD-2026-224277

2026-10-03T20:13:29.460966+00:00

EUVD-2026-224277

fkie_cve-2025-27612

2026-10-03T20:13:29.460986+00:00

libcontainer is a library for container control. Prior to libcontainer 0.5.3, while creating a tenant container, the tenant builder accepts a list of capabilities to be added in the spec of tenant container. The logic here adds the given capabilities to all capabilities of main container if present in spec, otherwise simply set provided capabilities as capabilities of the tenant container. However, setting inherited caps in any case for tenant container can lead to elevation of capabilities, similar to CVE-2022-29162. This does not affect youki binary itself. This is only applicable if you are using libcontainer directly and using the tenant builder.

GHSA-5w4j-f78p-4wh9 — Libcontainer is affected by capabilities elevation similar to GHSA-f3fp-gc8g-vw66

2026-10-03T20:13:29.461016+00:00

Affected: crates.io: libcontainer

### Impact In libcontainer, while creating a tenant container, the tenant builder accepts a list of capabilities to be added in the spec of tenant container. Code can be seen [here](https://github.com/youki-dev/youki/blob/9e63fa4da1672a78ca45100f3059a732784a5174/crates/libcontainer/src/container/tenant_builder.rs#L408) . The logic here adds the given capabilities to all capabilities of main container if present in spec, otherwise simply set provided capabilities as capabilities of the tenant container.

However, GHSA-f3fp-gc8g-vw66 was opened on runc mentioning that setting inherited caps in any case for tenant container can lead to elevation of capabilities. For this, they added a fix [here](https://github.com/opencontainers/runc/blob/986451c24e17c8d4be3c454f60b1f7be4af3e8b4/exec.go#L234-L242) where they never set new inherited caps on tenant, and set ambient caps only if original container had inherited caps.

Similarly crun never sets inherited caps as can be seen [here](https://github.com/containers/crun/blob/3ec6298abd79e144fbf3fa6db90793ff4c0516f9/src/exec.c#L319).

> [!NOTE] This does not affect youki binary itself, as the exec implementation is partially broken and does not pass on the user-provided caps to tenant containers, this is only applicable if you are using libcontainer directly and using the tenant builder.

### Workarounds - Do not pass any user-provided capabilities to the tenant builder, in which case no capabilities will be set on tenant. - Alternativel…

openSUSE-SU-2025:14937-1 — govulncheck-vulndb-0.0.20250327T184518-1.1 on GA media

2026-10-03T20:13:29.461056+00:00

govulncheck-vulndb-0.0.20250327T184518-1.1 on GA media