Vulnpedia
← Search CVEs

CVE-2026-93316

HIGH 7.1

Published 2026-10-05 · Last modified 2026-10-05

If BuildKit daemon is started with --cdi-disabled it can lead to daemon panic when builds try to use CDI devices. This can happen maliciously or by accident.

ELEVATED IMPACT

Severe if exploited (CVSS 7.1), but no known exploitation and low modeled probability. Patch on a normal cadence.

Exploitation likelihood

0.2%chance of exploitation in 30 days · 14th percentile

○ In CISA KEV ○ Catalogued PoC

Impact if exploited

7.1CVSS 4.0 · HIGH

  • ConfidentialityNone
  • IntegrityNone
  • AvailabilityHigh

What an attacker needs

  • ✓Access: Reachable over the network — no local access needed
  • ⚠Privileges: Requires a low-privilege account
  • ✓User interaction: No user interaction needed
  • ✓Complexity: No special conditions — reliably repeatable
  • ✓Requirements: No special attack requirements

✓ lowers the bar for an attacker · ⚠ raises it

Proof of concept

No public PoC is currently catalogued.

Search for new PoCs

Search GitHub now — results may be empty or unverified.

Tracked sources are checked daily for recent CVEs, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.

Data snapshot:

Affected

Vendors Moby

Products Buildkit

Weakness (CWE)

  • CWE-476: : NULL Pointer Dereference

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References and research data (JSON)

Vendor product assessments

  • buildah.src as a component of Red Hat Hardened Images · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/[email protected]?arch=src

    Red Hat · CVE-2026-93316 · Updated 2026-10-20T19:05:00+00:00
  • podman.src as a component of Red Hat Hardened Images · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/[email protected]?arch=src

    Red Hat · CVE-2026-93316 · Updated 2026-10-20T19:05:00+00:00
  • trivy.src as a component of Red Hat Hardened Images · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/[email protected]?arch=src

    Red Hat · CVE-2026-93316 · Updated 2026-10-20T19:05:00+00:00
  • quay/quay-builder-rhel8 as a component of Red Hat Quay 3 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not in execute path

    pkg:oci/quay-builder-rhel8?repository_url=registry.redhat.io/quay/quay-builder-rhel8

    Red Hat · CVE-2026-93316 · Updated 2026-10-20T19:05:00+00:00
  • quay/quay-builder-rhel9 as a component of Red Hat Quay 3 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not in execute path

    pkg:oci/quay-builder-rhel9?repository_url=registry.redhat.io/quay/quay-builder-rhel9

    Red Hat · CVE-2026-93316 · Updated 2026-10-20T19:05:00+00:00

All CVSS metrics

  • HIGH 7.1 v4.0 · CNA Primary
    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
  • HIGH 7.1 v4.0 · NVD Secondary
    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

References

Patches & mitigations

Advisories

Technical & other

Sources: NVD · CVE.org · EPSS