CVE-2026-24054 – A vulnerability in Kata Containers allows malfo... (How to Fix)

Q: What is the severity of CVE-2026-24054?

CVE-2026-24054 has a CVSS score of 10.0 (CRITICAL). A vulnerability in Kata Containers allows malformed container images with no layers to cause the host's block device to be mounted as read-only, potentially leading to filesystem corruption. This affects systems running Kata Containers versions prior to 3.26.0. The issue occurs when containerd bind-mounts an empty directory that Kata misinterprets as a block device.

📋 TL;DR

A vulnerability in Kata Containers allows malformed container images with no layers to cause the host's block device to be mounted as read-only, potentially leading to filesystem corruption. This affects systems running Kata Containers versions prior to 3.26.0. The issue occurs when containerd bind-mounts an empty directory that Kata misinterprets as a block device.

💻 Affected Systems

Products:

Kata Containers

Versions: All versions prior to 3.26.0

Operating Systems: Linux

Default Config Vulnerable: ⚠️ Yes

Notes: Requires containerd as container runtime and Kata Containers as runtime class. Only affects systems using Kata's VM-based isolation.

📦 What is this software?

Kata Containers by Katacontainers

View all CVEs affecting Kata Containers →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Host filesystem corruption leading to data loss or system instability requiring host reboot or recovery procedures.

🟠

Likely Case

Host block device mounted as read-only, causing service disruptions and potential data inconsistency.

🟢

If Mitigated

Minimal impact with proper image validation and runtime monitoring in place.

🌐 Internet-Facing: MEDIUM - Requires pulling malformed container images from untrusted registries.

🏢 Internal Only: MEDIUM - Internal registry compromise or developer error could trigger the vulnerability.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Exploitation requires ability to push malformed container images to a registry accessible by the target system.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 3.26.0

Vendor Advisory: https://github.com/kata-containers/kata-containers/security/advisories/GHSA-5fc8-gg7w-3g5c

Restart Required: Yes

Instructions:

1. Update Kata Containers to version 3.26.0 or later. 2. Update containerd to latest stable version. 3. Restart containerd service and any running Kata containers.

🔧 Temporary Workarounds

Image Validation

linux

Implement strict image validation to reject malformed container images before deployment.

# Use container image scanning tools like Trivy, Grype, or Clair
# Implement admission controllers in Kubernetes to validate images

Registry Restrictions

linux

Restrict container registries to trusted sources only.

# Configure containerd to only pull from approved registries
# Use Kubernetes ImagePolicyWebhook for registry validation

🧯 If You Can't Patch

Implement strict image provenance and signing requirements
Monitor for filesystem read-only events and block device mounting anomalies

🔍 How to Verify

Check if Vulnerable:

Check Kata Containers version: kata-runtime --version | grep -i version

Check Version:

kata-runtime --version

Verify Fix Applied:

Verify version is 3.26.0 or later and test with known malformed image to ensure proper error handling.

📡 Detection & Monitoring

Log Indicators:

Unexpected block device hotplug events in Kata logs
Filesystem read-only errors in host system logs
containerd errors about malformed images

Network Indicators:

Unexpected pulls of container images from untrusted sources

SIEM Query:

source="kata" AND ("hotplug" OR "block device") OR source="containerd" AND "malformed image"

📊 Metadata

CVE ID: CVE-2026-24054

CVSS v3 Score: 10.0 (CRITICAL)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H

CWE: CWE-754

EPSS Score: 0.06% exploit probability (18.5th percentile)

Published: January 29, 2026

Last Updated: February 24, 2026

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2026-24054, you might also want to check these: