This update for crun fixes the following issues:
Update to 1.20:
* krun: fix CVE-2025-24965. The .krun_config.json file could be created
outside of the container rootfs. (bsc#1237421)
* cgroup: reverted the removal of tun/tap from the default allow list,
this was done in crun-1.5. The tun/tap device is now added by default
again.
* CRIU: do not set network_lock unless explicitly specified.
* status: disallow container names containing slashes in their name.
* linux: Improved error message when failing to set the
net.ipv4.ping_group_range sysctl.
* scheduler: Ignore ENOSYS errors when resetting the CPU affinity mask.
* linux: return a better error message when pidfd_open fails with EINVAL.
* cgroup: display the absolute path to cgroup.controllers when a
controller is unavailable.
* exec: always call setsid. Now processes created through exec get the
correct process group id.
Update to...
Read the Full AdvisoryPatch Instructions:
To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- openSUSE Backports SLE-15-SP6:
zypper in -t patch openSUSE-2025-74=1
- openSUSE Backports SLE-15-SP6 (aarch64 i586 ppc64le s390x x86_64):
crun-1.20-bp156.2.3.1
https://www.suse.com/security/cve/CVE-2024-21626.html
https://www.suse.com/security/cve/CVE-2025-24965.html
https://bugzilla.suse.com/show_bug.cgi?id=1217590
https://bugzilla.suse.com/show_bug.cgi?id=1218894
https://bugzilla.suse.com/show_bug.cgi?id=1237421
Get the latest Linux and open source security news straight to your inbox.