A flaw in Podman’s default seccomp profile allows container processes to evade deny rules for AF_VSOCK and NETLINK_AUDIT. The kernel truncates 64‑bit socket arguments to 32 bits, so an attacker can set upper bits to bypass the equality check. This weakness, identified as CWE‑184, can enable privileged operations that are otherwise blocked by seccomp, effectively granting containers increased kernel interaction rights.

Red Hat Enterprise Linux 8, 9, and 10; Red Hat Hardened Images; Red Hat OpenShift Container Platform 4 and 5 are all affected as they deploy Podman and containers‑common that rely on the default seccomp profile.

The vulnerability has a CVSS score of 4.4 and no EPSS value is available, indicating low severity and uncertain exploit probability. It is not listed in the CISA KEV catalog. The most likely attack vector involves a compromised or malicious container that can manipulate socket arguments to bypass the seccomp denies, potentially allowing elevated interaction with the host kernel through AF_VSOCK or NETLINK_AUDIT even when SELinux is enabled. The exploitation requires local access to a container and the ability to supply specific socket arguments, making it a control‑bypass that can lead to privilege escalation.