CVE-2026-53495

Name of the Vulnerable Software and Affected Versions containerd versions prior to 1.7.35 containerd versions prior to 2.0.12 containerd versions prior to 2.2.8 containerd versions prior to 2.3.5

Description On Linux systems with the CRI plugin enabled, a bug in the CRI ExecSync implementation can cause the drainExecSyncIO goroutine in internal/cri/server/container execsync.go to block indefinitely. This occurs when CRI ExecSync is utilized by exec probes or lifecycle hooks that launch long-lived background child processes which retain standard input and output pipes. Because the I/O drain phase lacks a default timeout and does not stop when the request context is canceled, repeated invocations can lead to a leak of goroutines and host memory. This resource exhaustion may trigger the OOM killer to terminate the containerd daemon, resulting in a denial of service where the container runtime remains unavailable until it is restarted.

Recommendations Update to version 1.7.35. Update to version 2.0.12. Update to version 2.2.8. Update to version 2.3.5. Ensure exec probes and lifecycle hooks do not launch long-lived background child processes.