Impact

Successful exploitation allows for the tampering of confidential guest memory, effectively breaking the security boundary provided by confidential computing hardware and software stacks. This poses a significant risk to the integrity and confidentiality of workloads running in isolated environments.

Recommendation

Update the Kata Containers runtime to the latest security-hardened version provided by the upstream project. Review host-side access policies to ensure that only authorized processes have the ability to communicate with guest-side mem-agent sockets.

Attack Chain

1. Attacker gains root-equivalent access inside the Kata guest VM.
2. Attacker identifies the virtio-fs PCI device within the guest using /sys/devices/pci*.
3. Attacker takes control of a virtio-fs queue in userspace, bypassing the guest kernel's virtio-fs client.
4. Attacker sends a FUSE_INIT request to initialize the FUSE connection.
5. Attacker discovers the runtime-rs sandbox ID and constructs the path to a guest-controlled payload, such as /tmp/kata-go-escape-payload, using the passthrough mount.
6. Attacker crafts a raw FUSE_SYMLINK request. The request specifies a new symlink name as an absolute path on the host, e.g., /etc/cron.d/kata-go-escape-cron-<pid>, and sets the symlink target to point to the guest-controlled payload through a /proc/<pid>/root/... path.
7. The host virtiofsd receives the FUSE_SYMLINK request and, due to the lack of proper validation, creates the symlink on the host filesystem in the specified location.
8. Host cron reads the /etc/cron.d directory, follows the newly created symlink, and executes the guest-controlled payload as host root.

Impact

Successful exploitation leads to complete compromise of the host system, as the attacker gains the ability to execute arbitrary commands as root. This allows the attacker to bypass the Kata Containers isolation and potentially access sensitive data, disrupt services, or further compromise the host infrastructure. The provided PoC demonstrated this vulnerability, confirming guest-root to host-root command execution by creating a proof file in the host's /run directory. This bypasses the container's isolation and impacts the entire host system.

Recommendation

• Upgrade to a patched version of Kata Containers that addresses CVE-2026-47243 to prevent exploitation.
• Monitor process creation events on the host for the execution of unexpected binaries from /etc/cron.d using the provided Sigma rule Detect Cron Job File Creation.
• Implement host-based intrusion detection systems (HIDS) to monitor for suspicious file system activity, particularly the creation of symlinks in sensitive directories such as /etc/cron.d.
• Review and harden the configuration of virtiofsd to ensure proper validation of file paths and prevent the creation of symlinks outside the intended shared directory.
• Enable and configure seccomp profiles to restrict the capabilities of the virtiofsd process, limiting its ability to perform actions that could lead to privilege escalation.

Attack Chain

1. The attacker identifies a target file within the guest container image, such as a binary or configuration file they wish to overwrite.
2. The attacker crafts a CopyFileRequest to create a symbolic link within the /run/kata-containers/shared/containers directory.
3. The path parameter of the request specifies the location of the symlink within the shared directory.
4. The data parameter of the request specifies the target of the symbolic link, which points to the target file identified in step 1, inside the guest file system.
5. The Kata Agent processes the CopyFileRequest, creating the symbolic link within the shared directory, pointing to the target file inside the container image.
6. The attacker crafts a second CopyFileRequest to copy malicious data into the symlink created in step 5.
7. The Kata Agent writes the malicious data to the symlink, which then overwrites the original target file within the container image.
8. The attacker restarts the container or waits for the compromised binary to be executed, achieving arbitrary code execution within the guest.

Impact

Successful exploitation allows attackers to overwrite arbitrary files within container images managed by Kata Containers. This can lead to arbitrary code execution within the guest environment, data exfiltration, and privilege escalation. This is particularly critical in Confidential Containers environments where the trust model explicitly forbids host access to container images. Affected systems are those employing the upstream genpolicy implementation.

Recommendation

• Apply the patch or upgrade to go/github.com/kata-containers/kata-containers version 0.0.0-20260422180503-1b9e49eb2763 or later to address CVE-2026-41326.
• Monitor the creation of symbolic links within the /run/kata-containers/shared/containers directory, using the provided Sigma rule, as this is an unusual operation (file_event).
• Implement strict access controls and monitoring for the Kata Agent to prevent unauthorized CopyFileRequest messages.