CVE-2026-16460
7.4HighPublished 19 Oct 2026 · NVD status: Received · AI triage by gemini-3.8-flash
- Attack vector
- Local
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-345
Impact
A local attacker can achieve full host compromise on reboot by triggering execution of unsigned operating system content. This requires an unsigned container image to have already been staged under an older, permissive signature verification policy.
Root cause
Bootc and ostree finalize previously staged deployments without re-verifying the deployment container image against newly updated, hardened container signature policies.
Affected systems
bootc and ostree (exact affected version numbers are not listed in the advisory).
CVSS v3.1 · CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Fix & remediation
Upgrade bootc and ostree packages once fixed versions are published by your vendor. As an interim workaround, manually clean or discard any unverified staged deployments via bootc or ostree prior to applying hardened signature policies and rebooting.
$ rpm -q bootc ostree || dpkg -l bootc ostreeAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
A flaw was found in bootc and ostree. Already-staged deployments are finalized without revalidating the deployment's container image against the current containers signature policy. Unsigned OS content staged under a prior permissive policy can remain bootable after policy is hardened to reject unsigned images, leading to full host compromise on reboot.