| Name | CVE-2026-94603 |
| Description | Podman is a tool for managing OCI containers and pods. From 4.4.0 until 5.8.8 and 6.1.3, podman run treats an image carrying the io.podman.annotations.checkpoint.runtime.name annotation as a checkpoint and silently ignores user-supplied container creation restrictions such as --cap-drop=ALL, allowing image-controlled checkpoint state to select weaker sandbox settings and capabilities. Rootless containers are not affected because checkpoint and restore are unavailable in that mode. This issue is fixed in versions 5.8.8 and 6.1.3. |
| Source | CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
| Debian Bugs | 1149955 |
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|---|---|---|
| podman (PTS) | trixie | 5.4.2+ds1-2 | vulnerable |
| forky, sid | 5.8.6+ds1-3 | fixed |
The information below is based on the following data on fixed versions.
| Package | Type | Release | Fixed Version | Urgency | Origin | Debian Bugs |
|---|---|---|---|---|---|---|
| podman | source | (unstable) | 5.8.6+ds1-3 | 1149955 |
https://bugzilla.redhat.com/show_bug.cgi?id=2542566
https://github.com/podman-container-tools/podman/security/advisories/GHSA-2cvf-wqm6-wr9g
Fixed by: https://github.com/podman-container-tools/podman/commit/3721ff82ffb44a4ceeaecc5abd3808e924a6b669 (main)
Fixed by: https://github.com/podman-container-tools/podman/commit/c74b1d37b3fb834b0de43e176565d9d8c254b627 (main)
Fixed by: https://github.com/podman-container-tools/podman/commit/fa6cef22c2baf3987b581c673bb416ef0585daf7
Fixed by: https://github.com/podman-container-tools/podman/commit/7728ba0a90094408ad9078e36c3622a651d49616 (v5.8.8)
Fixed by: https://github.com/podman-container-tools/podman/commit/24706290d5c974f078d8ca284026802515f28e92 (v5.8.8)
Fixed by: https://github.com/podman-container-tools/podman/commit/29c8c6e50607df7a7d735ace09ff0ea099c0b3e0 (v5.8.8)