CVE-2026-41579: SUSE runc Filesystem Integrity Flaw — Detection and Remediation Guide for Container Hosts

---
title: Container Started With Host Root or Sensitive Path Bind Mount
id: 3f8a2c91-7d4e-4b1a-9c6d-2e5f8a1b3c47
status: experimental
description: Detects container runtime invocations that bind-mount the host root filesystem or sensitive host paths, a common precondition and indicator for container escape and host filesystem integrity attacks including CVE-2026-41579 style abuse.
references:
  - https://linuxsecurity.com/advisories/suse/suse-2026-23164-1-runc
  - https://attack.mitre.org/techniques/T1611/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.privilege_escalation
  - attack.t1611
logsource:
  category: process_creation
  product: linux
detection:
  selection_runtime:
    Image|endswith:
      - '/docker'
      - '/podman'
      - '/nerdctl'
      - '/ctr'
  selection_args:
    CommandLine|contains:
      - 'run'
  selection_mounts:
    CommandLine|contains:
      - '-v /:/'
      - '--volume /:/'
      - '-v /etc:/'
      - '-v /var:/'
      - '-v /root:/'
      - '--mount type=bind,source=/'
      - '--privileged'
  condition: selection_runtime and selection_args and selection_mounts
falsepositives:
  - Legitimate administrative tooling and backup agents that mount host paths
  - Security agents deployed as privileged containers
level: high
---
title: Runc or Containerd Spawned Suspicious Child Process During Container Setup
id: 8b4d1e62-3a7f-4c29-b5e8-9d2c6f4a1e35
status: experimental
description: Detects runc or containerd spawning interactive shells or file modification tooling, which may indicate exploitation of a runtime filesystem handling flaw such as CVE-2026-41579 during malicious image processing.
references:
  - https://linuxsecurity.com/advisories/suse/suse-2026-23164-1-runc
  - https://attack.mitre.org/techniques/T1611/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.privilege_escalation
  - attack.t1611
  - attack.execution
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/runc'
      - '/containerd-shim'
      - '/containerd'
  selection_child:
    Image|endswith:
      - '/bash'
      - '/sh'
      - '/zsh'
      - '/chown'
      - '/chmod'
      - '/mount'
      - '/umount'
  condition: selection_parent and selection_child
falsepositives:
  - Container entrypoints legitimately executing shell scripts (reduce noise by scoping to runc parent only, not containerd-shim)
level: medium
---
title: Image Pulled From Non-Approved Registry
id: 5c9e3a47-2f8b-4d61-a7c3-1e6b9d4f2a58
status: experimental
description: Detects container image pulls from registries outside an approved baseline, a delivery precondition for malicious-image attacks against runc such as CVE-2026-41579. Populate the filter list with your approved registries.
references:
  - https://linuxsecurity.com/advisories/suse/suse-2026-23164-1-runc
  - https://attack.mitre.org/techniques/T1204/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1204
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    Image|endswith:
      - '/docker'
      - '/podman'
      - '/nerdctl'
    CommandLine|contains:
      - 'pull'
      - 'run'
  filter_approved:
    CommandLine|contains:
      - 'registry.example.com'
      - 'registry.suse.com'
      - 'mcr.microsoft.com'
  condition: selection and not filter_approved
falsepositives:
  - Developers pulling from public registries in non-production environments
level: medium

// Hunt: container runtime activity indicative of malicious image handling or host path mounts
// Works against Syslog/CEF-ingested SUSE Micro hosts in Microsoft Sentinel
Syslog
| where TimeGenerated > ago(24h)
| where ProcessName in ("docker", "podman", "runc", "containerd", "nerdctl")
| where SyslogMessage has_any ("-v /:/", "--volume /:/", "--privileged", "--mount type=bind,source=/")
   or (ProcessName =~ "runc" and SyslogMessage has_any ("error", "failed", "permission denied", "read-only file system"))
| project TimeGenerated, Computer, ProcessName, SyslogMessage, HostIP
| order by TimeGenerated desc

// Correlate: hosts running outdated runc that also show container activity
// Assumes a heartbeat or inventory source; join with your asset data as needed
union Syslog
| where TimeGenerated > ago(7d)
| where SyslogMessage has "runc"
| summarize LastRuncEvent = max(TimeGenerated), EventCount = count() by Computer, ProcessName
| order by EventCount desc

-- Artifact: Linux.Runc.ContainerHygieneAudit
-- Hunts for runc/containerd processes and host-risky bind mounts on SUSE Micro nodes

-- 1. Running container runtime processes and their command lines
SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Name =~ 'runc|containerd|dockerd|podman'

-- 2. Mount table entries that expose host paths into container namespaces
SELECT Device, MountPoint, FSType, Options
FROM parse_file(filename='/proc/mounts', accessor='proc')
WHERE MountPoint =~ '/var/lib/(docker|containers|containerd)'
   OR Options =~ 'rw,relatime' AND Device =~ 'overlay'

-- 3. Identify runc binary version for patch verification
SELECT FullPath, Mtime, Size
FROM glob(globs='/usr/sbin/runc')
   OR FullPath =~ '/usr/bin/runc'

#!/bin/bash
# CVE-2026-41579 runc remediation and verification for SUSE Linux Micro 6.1
# Advisory: SUSE 2026-23164-1

set -euo pipefail

# 1. Check current runc version
runc --version || echo "runc not found at default path"
rpm -q runc 2>/dev/null || echo "runc package not installed"

# 2. Apply the security update (SLE Micro uses transactional-update)
# This stages the patch and requires a reboot into the new snapshot
transactional-update pkg update runc

# 3. Reboot into the updated snapshot (schedule per change window)
echo "[*] Reboot required to activate the transactional snapshot."
echo "    Run: systemctl reboot"

# 4. Post-reboot verification
runc --version
rpm -q --changelog runc | grep -i "CVE-2026-41579" && \
  echo "[+] Patch for CVE-2026-41579 confirmed in package changelog" || \
  echo "[-] CVE reference not found — verify update applied"

# 5. Verify no containers are mounting host root (audit, don't auto-remediate)
echo "[*] Auditing running containers for host path mounts..."
if command -v docker &>/dev/null; then
  docker ps -q | while read -r cid; do
    docker inspect "$cid" --format '{{.Name}} {{range .Mounts}}{{.Source}}:{{.Destination}} {{end}}'
  done | grep -E '/:/|/etc:|/var:|/root:' || echo "[+] No risky host mounts found"
fi

# 6. Restrict image provenance (defense in depth)
# Enforce an approved-registry policy via your orchestrator's admission control
# (e.g., Kubernetes ValidatingAdmissionPolicy / OPA Gatekeeper) or podman registries.conf
echo "[*] Review /etc/containers/registries.conf for unqualified-search-registries exposure"
grep -r "unqualified-search-registries" /etc/containers/ 2>/dev/null || true