CVE-2025-52881: runc: LSM labels can be bypassed with malicious config using dummy procfs files

Overview

Severity

High (CVSS 7.3)

CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U

Exploit Status

Not Exploited

Patch Tuesday

2025-Nov

Released

2025-11-09

Last Updated

2026-01-13

EPSS Score

0.80% (percentile: 56.6%)

Detection & Weaponization (1 sources)

Maturity: Exploit

• GitHub PoC: 1 repositories

Affected Products (6)

Open Source Software

• cbl2 moby-runc 1.1.9-9 on CBL Mariner 2.0
• cbl2 kubernetes 1.28.4-19 on CBL Mariner 2.0
• azl3 kubernetes 1.30.10-14 on Azure Linux 3.0
• azl3 kubernetes 1.30.10-16 on Azure Linux 3.0
• azl3 kubernetes 1.30.10-18 on Azure Linux 3.0
• azl3 runc 1.3.3-1 on Azure Linux 3.0

Revision History

• 2025-11-09: Information published.
• 2025-11-21: Information published.
• 2025-12-07: Information published.
• 2026-01-03: Information published.
• 2026-01-08: Information published.
• 2026-01-13: Information published.