--- cve: "CVE-2026-24054" severity: "HIGH" cvss: 8.8 epss: "0.5%" vendor: "kata-containers" kev: false exploited: false published: "2026-01-29 17:16:56" tags: [cve, security, high] source: tsecurity.de CVE-Dossier exported: "2026-09-21T14:48:44+02:00" --- # CVE-2026-24054 > 8.8 HIGH · 🧪 PoC ## Beschreibung Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines (VMs) that perform like containers. In versions prior to 3.26.0, when a container image is malformed or contains no layers, containerd falls back to bind-mounting an empty snapshotter directory for the container rootfs. When the Kata runtime attempts to mount the container rootfs, the bind mount causes the rootfs to be detected as a block device, leading to the underlying device being hotplugged to the guest. This can cause filesystem-level errors on the host due to double inode allocation, and may lead to the host's block device being mounted as read-only. Version 3.26.0 contains a patch for the issue. ## CVSS-Vektor ``` CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H/E:P ``` | Metrik | Wert | Bewertung | |---|---|---| | AV Angriffsvektor | Netzwerk | bad | | AC Komplexität | Gering | bad | | PR Privilegien | Keine | bad | | UI Interaktion | Keine | bad | ## Patch verfügbar (OSV) - b85393e70b041e6d53f886ace84b5fb62fe70dc0 (Commit) - 20ca4d2d79aa5bf63aa1254f08915da84f19e92a (Commit) ## Referenzen - - - - - --- _Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/cve?cve=CVE-2026-24054) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI BITS_