[CLSA-2026:1791475845] Fix CVE(s): CVE-2026-87766

Type:

security

Severity:

Important

Release date:

2026-10-08 23:16:00 UTC

Description:

   * SECURITY UPDATE: symlink traversal during sandbox setup lets a crafted
     source tree redirect file/dir creation and mounts outside the sandbox
     (sandbox escape)
     - debian/patches/CVE-2026-87766.patch: resolve every destination inside
       /newroot and every source inside /oldroot a component at a time
       (safe_openat in utils.c), create and mount through O_PATH|O_NOFOLLOW fds
       passed to the privileged helper (bind_mount_fd), and refuse to mount on
       a symlink destination (bubblewrap.c, bind-mount.c, utils.c)
     - CVE-2026-87766

CVEs fixed:

CVE-2026-87766

Updated packages:

bubblewrap_0.2.1-1ubuntu0.1+tuxcare.els2_amd64.deb
sha:8934923426a72688d2b7b24e8959b16fc23859c7

Notes:

This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.