Linuxfoundation Containerd — CVE-2026-53492 (Critical)

Date Jul 1, 2026

Type Vendor advisory

Signal Critical vendor advisory

Vendor / Product Linuxfoundation · Containerd

CVE CVE-2026-53492

Critical vendor advisory CVE-2026-53492

Summary

containerd is an open-source container runtime. In Versions prior to 2.3.2, 2.2.5 and 2.1.9, the CRI implementation improperly trusts Container Device Interface (CDI) annotations found within untrusted checkpoint image metadata during container restoration. When restoring a container from a checkpoint, containerd preserves CDI-related annotations from the checkpoint archive rather than relying solely on the pod's create-time specification. This allows a user with pod creation permissions to bypass standard Kubernetes resource allocation and device plugin enforcement, injecting arbitrary CDI ed

Why it matters

This CVE carries a CRITICAL severity rating (CVSS 9.6) in Linuxfoundation Containerd. Patch or mitigate promptly. EPSS percentile: 33%.

Operator check

Review CVE-2026-53492 in your asset inventory. Apply patches per vendor guidance and verify Containerd is not exposed. CVSS score: 9.6. EPSS probability: 0.4%; percentile: 33%.

Sources

NVD — CVE-2026-53492 Source reference

PatchBrief uses public sources. It does not scan environments, verify exposure, or replace vendor guidance.

Get watched-vendor alerts Subscribe free Back to feed