Containerd CRI Checkpoint Restore Privilege Escalation

CVE-2026-95837 describes a critical flaw in the containerd CRI plugin where container restoration from untrusted checkpoints via the CreateContainer API ignores destination security contexts. Instead of enforcing the security policies defined by the orchestrator, containerd restores sensitive process state - including Linux capabilities, UIDs/GIDs, no_new_privs, and seccomp filters - directly from the checkpoint archive. This allows an attacker to manipulate the checkpoint image to execute code with elevated privileges, effectively bypassing isolation mechanisms.

The vulnerability is particularly dangerous because containerd's internal status reporting inaccurately reflects the requested (restricted) configuration rather than the actual (elevated) state of the restored process, misleading security monitoring systems. Affected versions include containerd v2.1.0 through v2.2.6, and v2.3.0 through v2.3.3. This feature is disabled by default in fixed versions 2.2.7 and 2.3.4, and entirely removed in 2.4.0.

Impact

Successful exploitation allows a containerized process to escape restrictive security policies and execute as root with full Linux capabilities. This could lead to container escapes, host-level compromise, or the circumvention of organization-wide security posture. Impact is limited to environments utilizing containerd with CRI checkpoint restore enabled.

Recommendation

• Upgrade containerd to version 2.2.7, 2.3.4, or 2.4.0 immediately to resolve CVE-2026-95837.
• Terminate and delete any existing running containers that were restored using the CRI checkpoint restore feature to ensure no persistence of compromised states.
• Implement admission controllers to scan container images and reject any images containing CRIU checkpoint data unless verified as trusted.
• Restrict access to the CreateContainer API to trusted administrative users only until the patch is applied.