CVE-2026-84042: Red Hat Enterprise Linux 10

High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days.

A flaw was found in crun. When crun is built with libkrun and a container is started rootful with passt networking (krun.use_passt), crun can execute attacker-controlled payload from the container image with host root privileges. The issue is a regression in crun 1.29. It affects crun >= 1.29

Affected products

• Red Hat Red Hat Enterprise Linux 10
• Red Hat Red Hat Enterprise Linux 8
• Red Hat Red Hat Enterprise Linux 9
• Red Hat Red Hat Hardened Images
• Red Hat Red Hat Openshift Container Platform 4

Published 2026-09-10. Last modified 2026-09-15.