{"id":"AZL-75770","summary":"CVE-2026-24054 affecting package kata-containers for versions less than 3.19.1.kata2-3","details":"Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines (VMs) that perform like containers. In versions prior to 3.26.0, when a container image is malformed or contains no layers, containerd falls back to bind-mounting an empty snapshotter directory for the container rootfs. When the Kata runtime attempts to mount the container rootfs, the bind mount causes the rootfs to be detected as a block device, leading to the underlying device being hotplugged to the guest. This can cause filesystem-level errors on the host due to double inode allocation, and may lead to the host's block device being mounted as read-only. Version 3.26.0 contains a patch for the issue.","modified":"2026-04-21T04:38:58.803734Z","published":"2026-01-29T18:16:15Z","upstream":["CVE-2026-24054"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-24054"}],"affected":[{"package":{"name":"kata-containers","ecosystem":"Azure Linux:3","purl":"pkg:rpm/azure-linux/kata-containers"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.19.1.kata2-3"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-75770.json"}}],"schema_version":"1.7.5"}