CVE-2026-92574 Red Hat CVE debrief

Who should care

Defenders responsible for CRI-O deployments, especially those using checkpoint restore functionality, should assess exposure and verify the security context of affected containers.

Why it matters

Defenders should prioritize verifying exposure in CRI-O deployments using checkpoint restore functionality, assess the security context of affected containers, and monitor for malicious checkpoint images to prevent exploitation and potential privilege escalation.

• Verify exposure in CRI-O deployments using checkpoint restore functionality
• Assess security context of affected containers to prevent privilege escalation
• Monitor for malicious checkpoint images to prevent exploitation
• Prioritize updates to fixed versions when available

Technical summary

The vulnerability allows a user with permission to create a pod from a malicious checkpoint image to bypass the destination Kubernetes security context, potentially leading to execution with elevated privileges. Affected upstream supported versions are CRI-O 1.34 and later. Downstream Red Hat products are affected from OCP 4.17 onward. Exploitation requires permission to create a pod from a malicious checkpoint image and checkpoint restore functionality to be available. The restored process may retain credentials, Linux capabilities, no_new_privs, and seccomp state from the checkpoint instead of enforcing the destination configuration.

Defensive priority

Defenders should prioritize verifying exposure in CRI-O deployments, especially those using checkpoint restore functionality, and assess the security context of affected containers.

Recommended defensive actions

• Verify CRI-O deployments for exposure, especially those using checkpoint restore functionality
• Assess the security context of affected containers
• Monitor for malicious checkpoint images
• Update to fixed versions when available
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but information on exploitation and impact is limited. Defenders should verify exposure in CRI-O deployments using checkpoint restore functionality, assess the security context of affected containers, and monitor for malicious checkpoint images. The vulnerability allows a user with permission to create a pod from a malicious checkpoint image to bypass the destination Kubernetes security context, potentially leading to execution with elevated privileges. Limited source

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.