Technical impact
BuildKit can experience a panic when the daemon is launched with the --cdi-disabled flag and builds attempt to use CDI devices. The flaw is a null pointer dereference that terminates the daemon, interrupting any continuous integration pipelines or other services that rely on BuildKit for execution.
Affected Systems
The issue affects the moby BuildKit project. Any installation that starts the daemon with the --cdi-disabled flag—whether from a command line argument or a TOML configuration—is vulnerable. The advisory references release v0.33.1, indicating that the vulnerability exists in that version and likely earlier releases that support the flag.
Risk and Exploitability
With a CVSS score of 7.1 the vulnerability represents moderate to high risk. The EPSS score of less than 1% suggests limited exploitation activity, and the flaw is not currently listed in CISA KEV. An attacker who can influence daemon startup or build configuration can trigger the panic by enabling the flag or by forcing builds to use CDI devices, resulting in a denial of service. The likely exploit would involve modifying daemon launch scripts or configuration files on systems with BuildKit installed.
