Containerd (2.1.0 to <2.2.7, 2.3.0 to <2.3.4)

A vulnerability in the containerd CRI implementation (CVE-2026-95837) allows untrusted container checkpoints to bypass configured security contexts, enabling privilege escalation to root.