Fixed
Created: Oct 23, 2026
Updated: Oct 27, 2026
Resolved Date: Oct 23, 2026
Found In Version: 10.22.33.2
Fix Version: 10.22.33.7
Severity: Standard
Applicable for: Wind River Linux LTS 22
Component/s: Userspace
A vulnerability in CRI-O checkpoint restore allows a user who can create a pod from a malicious checkpointed container to bypass the destination Kubernetes security context. The restored process may retain credentials, Linux capabilities, no_new_privs, and seccomp state from the checkpoint instead of enforcing the destination configuration. This can allow execution with elevated privileges across the container security boundary. Affected upstream supported versions are CRI-O 1.34 and later. Downstream Red Hat products are affected from OCP 4.17 onward. Fixes have been applied to supported branches but are not yet released. Exploitation requires permission to create a pod from a malicious checkpoint image and checkpoint restore functionality to be available.
Data source: Red Hat, Inc. (secalert@redhat.com)
