CVE-2026-95837

Name of the Vulnerable Software and Affected Versions containerd versions 2.1.0 through 2.2.6 containerd versions 2.3.0 through 2.3.3

Description The CRI CreateContainer checkpoint restore process in containerd is flawed because CRIU (Checkpoint/Restore In Userspace) restores the process security state directly from checkpoint data rather than enforcing the destination ContainerConfig. An attacker capable of creating a container from a crafted checkpoint can inject restored credentials, capabilities, no new privs, and seccomp state. This allows the restored process to execute as root with full capabilities and without enforced seccomp filters, even though the CRI status incorrectly reports that the requested configuration is active.

Recommendations Update containerd to version 2.2.7. Update containerd to version 2.3.4.