A process can have its apparent root changed while an already-open working directory still refers to a location outside that root. If the jail launches an untrusted workload without checking the resulting current-directory context, the workload can inherit access it was not intended to keep. The Kata Containers patch describes a process retaining a working…
Inspect the ClaimsCase · DiggingBeagle record
Kata Containers process could retain a working directory outside its expected root
A separate Kata fix addresses procfs magic-link and working-directory behavior after namespace transitions. The affected root is the guest environment, not evidence of physical host root access.
Scope
The described boundary is within a Kata guest system and the report does not prove hypervisor escape or compromised customer machines. This is a distinct issue from Kata capability-limit spoofing.
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- demonstrated
- Evidence
- Grade B
- Remediation
- fixed reported
- AI role
- AGAINST AI
Basis and provenance
Enrich update: CLM-ENRICH-20261027-13 cites SRC-2026-CP21-KATA-PROC-MAGIC-CWD at Kata Containers pull request 13587, agent: reject cwd outside the container root. New evidence concerns the bounded reported mechanism, prerequisite or outcome; setting research_demonstration; exploit status demonstrated; remediation status fixed_reported. No independently comparable impact scale, affected production population or universal exploit success measure was established, so the impact band remains null. Original Claims remain individually attributable and any observed incident or simulated result is distinguished in the narrative.
Assessed Oct 27, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-ENRICH-20261027-13 · Kata Containers PR 13587: working directory validation after procfs root transitions
At a glance
Root path labels are insufficient if the kernel still retains a usable path reference outside that root.
Read the implicationsThe described boundary is within a Kata guest system and the report does not prove hypervisor escape or compromised customer machines. This is a distinct issue from Kata capability-limit spoofing.
Limits and uncertaintyFull account
A process can have its apparent root changed while an already-open working directory still refers to a location outside that root. If the jail launches an untrusted workload without checking the resulting current-directory context, the workload can inherit access it was not intended to keep.
The Kata Containers patch describes a process retaining a working directory outside the expected container root after a /proc/<pid>/root transition and adds a getcwd failure check to reject the state. The described boundary is within a Kata guest system and the report does not prove hypervisor escape or compromised customer machines. This is a distinct issue from Kata capability-limit spoofing.
Validate both root and working-directory containment after namespace changes, including procfs magic links, deleted paths and error-return states. Root path labels are insufficient if the kernel still retains a usable path reference outside that root. Primary evidence.
This is an upstream guest-sandbox boundary relevant to OpenAI's frontier-agent containment investigation, not independent evidence of host escape or a new deployed customer compromise. The containment link explains its AI-agent relevance.
Additional evidence and trust boundary
The relevant scope is a process context inside the Kata guest. A /proc/<pid>/root magic link can affect path resolution, and retaining a directory descriptor outside the intended root can survive the apparent root switch. A jail should validate root and working directory together. This is not evidence that the workload escaped the hypervisor onto the physical host. Supporting record.
Mechanism and trust boundary
- 01
Step
- 02
Step
- 03
Step
Timeline
- Oct 23, 2026disclosure
Public disclosure
Claims & evidence
CLM-ENRICH-20261027-13The Kata Containers patch rejects a process with an inaccessible or escaped current working directory by checking the getcwd outcome after the root transition, rather than assuming changing the root also changes the current directory.supported
Basis: reported finding
- supportsKata Containers PR 13587: working directory validation after procfs root transitionsprimary disclosure
Kata Containers pull request 13587, agent: reject cwd outside the container root
CLM-CP21-KATA-PROC-MAGIC-CWD-1The Kata Containers patch describes a process retaining a working directory outside the expected container root after a /proc/<pid>/root transition and adds a getcwd failure check to reject the state.supported
Basis: reported finding
- supportsKata Containers PR 13587: working directory validation after procfs root transitionsprimary disclosure
PR 13587 description: procfs magic links, getcwd ENOENT and guard
Implications
Root path labels are insufficient if the kernel still retains a usable path reference outside that root.
Controls and mitigations
- Validate both root and working-directory containment after namespace changes, including procfs magic links, deleted paths and error-return states.
Unknowns and contradictions
- The described boundary is within a Kata guest system and the report does not prove hypervisor escape or compromised customer machines. This is a distinct issue from Kata capability-limit spoofing.
Sources and citation
Material revision history
- Oct 27, 2026 · Canonical change recorded · new in release · revision 196