{"affected":[{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"containers-common","product":"Red Hat Enterprise Linux 10","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unaffected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"container-tools:rhel8/containers-common","product":"Red Hat Enterprise Linux 8","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"containers-common","product":"Red Hat Enterprise Linux 9","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unaffected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"containers-common","product":"Red Hat Hardened Images","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"podman","product":"Red Hat Hardened Images","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unaffected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"skopeo","product":"Red Hat Hardened Images","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unaffected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"containers-common","product":"Red Hat OpenShift Container Platform 4","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift/ose-rhel-coreos-8","product":"Red Hat OpenShift Container Platform 4","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift/ose-rhel-coreos-9","product":"Red Hat OpenShift Container Platform 4","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift/ose-rhel-coreos-9","product":"Red Hat OpenShift Container Platform 5","source":"CNA: redhat","vendor":"Red Hat","versions":[]}],"cveId":"CVE-2026-123876","cwes":["CWE-184"],"description":"A flaw was found in the default seccomp profile used by Podman via containers-common. Deny rules for AF_VSOCK and NETLINK_AUDIT compared socket arguments with unmasked 64-bit equality. Because the kernel truncates those int arguments to 32 bits, setting upper bits can bypass the deny rules.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":4.4,"severity":"medium","source":"CNA: redhat","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","version":"3.1"}],"modifiedAt":1794000785303,"publishedAt":1793986721186,"references":[{"source":"CNA: redhat","tags":["vdb-entry","x_refsource_REDHAT"],"url":"https://access.redhat.com/security/cve/CVE-2026-123876"},{"source":"CNA: redhat","tags":["issue-tracking","x_refsource_REDHAT"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2566536"},{"source":"CNA: redhat","tags":[],"url":"https://github.com/podman-container-tools/container-libs/issues/1248"},{"source":"CNA: redhat","tags":[],"url":"https://github.com/podman-container-tools/container-libs/pull/1249"},{"source":"CNA: redhat","tags":[],"url":"https://www.openwall.com/lists/oss-security/2026/10/27/3"}],"remediation":[{"kind":"workaround","source":"CNA: redhat","text":"Enforcing SELinux may still deny vsock; do not rely on the unfixed seccomp denies; ship SCMP_CMP_MASKED_EQ profile updates."}],"revision":"823e688f48d8ce0e32d79c3dd98327de7639925d43745a43a68aed389154d21c","sources":[{"modifiedAt":1794000785303,"name":"CNA: redhat","retrievedAt":1794002923985,"url":"https://www.cve.org/CVERecord?id=CVE-2026-123876"}],"ssvc":null,"status":"published","title":"Podman: containers-common: containers-common: default seccomp af_vsock/netlink_audit deny rules bypassable via 32-bit truncation","updatedAt":1794002923985}