CVE-2026-93316

HighCVSS 7.1/10Last modified Oct 6, 2026

Description

If BuildKit daemon is started with --cdi-disabled it can lead to daemon panic when builds try to use CDI devices. This can happen maliciously or by accident.

Metrics

CVSS 4.0 7.1/10CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-476

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Oct 5, 2026
Last modified
Oct 6, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-933175.9An unauthenticated attacker controlling a registry or OCI-layout blob source could provide blob contents that did not match the claimed digeCVE-2026-933187.5A malicious image can advertise DiffIDs from another image while containing different layer contents. In affected versions, BuildKit could uCVE-2026-933195.7A malicious external BuildKit frontend can send requests using the internal API that can create conditions for a data race that can cause thCVE-2026-933206.0BuildKit may be tricked into performing file actions with special file inodes where regular files are expected. Special files may block operCVE-2026-933216.9A malicious frontend can submit an LLB definition that causes buildkitd to panic and terminate, interrupting all builds running on that daemCVE-2026-933226.9A malicious frontend can submit an LLB definition that causes buildkitd to panic and terminate, interrupting all builds running on that daemCVE-2026-933236.8The Dockerfile frontend loaded the Dockerfile and .dockerignore files of a build context into memory without a size limit. A build context cCVE-2026-933266.0A build step for a Git source, crafted in a specific way, can bypass some policy validation rules. A malicious build definition can make theCVE-2026-933304.3Improper rule enforcement in the PAM Active Directory provider in Devolutions Server 2026.3.5 allows a user with PAM edit permissions to bypCVE-2026-933317.3A vulnerability was identified in GPAC 26.08-DEV. This vulnerability affects the function gf_rtp_parse_ttxt of the file src/ietf/rtp_depackeCVE-2026-933325.4Improper access control in the partial connection API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated low-privileged usCVE-2026-933367.1Missing authorization in the unit resources download route in Canonical Juju 4.0 through 4.0.15 allows a controller-authenticated principal