Debian Patches

Status for docker.io/26.1.5+dfsg1-9+deb13u1

Patch Description Author Forwarded Bugs Origin Last update
engine-CVE-2026-34040-authz-reject-oversized-body.patch pkg/authz: Reject requests exceeding body size limit
Previously, the authorization system would silently skip body inspection when
request bodies exceeded the maximum size limit (1MiB).

The authorization plugins would receive an empty body for inspection
while the actual large payload would still be processed by the Docker
daemon, allowing malicious requests to circumvent plugin-based security
controls.

(cherry picked from commit 7a767b27fd1238c89a5cc926c39e27d3bcf58e35)		 Paweł Gronowski <pawel.gronowski@docker.com> no 2026-02-16
engine-CVE-2026-34040-authz-body-limit-4mib.patch pkg/authz: Increase body limit to 4 MiB
Some endpoint could potentially use a body request than 1 MiB without
malicious intent.

(cherry picked from commit ec76e941838797fc762185c556c152f0a032d387)		 Paweł Gronowski <pawel.gronowski@docker.com> no 2026-02-16
engine-CVE-2026-33997-plugin-privilege-off-by-one.patch plugin: Fix off-by-one in privilege validation
Fix an off-by-one error in isEqual() where the comparison loop started
at index 1 instead of 0, causing the first privilege (after sorting
alphabetically by name) to never be validated.

This allowed a malicious plugin to request different values for
whichever privilege sorts first — most notably "allow-all-devices",
which grants unrestricted rwm access to all host devices.

The bug also meant that plugins requesting exactly one privilege had
zero iterations of the comparison loop, bypassing validation entirely.

Also fix an existing test case ("diff-order-but-same-value") that only
passed due to the off-by-one bug, and add test cases for single-element
and first-sorted-element mismatches.

(cherry picked from commit 99a095ecf04e8849318f2811bb3f687905eab09b)		 Paweł Gronowski <pawel.gronowski@docker.com> no 2026-03-19
engine-CVE-2026-41568-copy-symlink-escape.patch daemon/copy: Fix symlink escape in mount destination creation Use os.Root to scope all filesystem operations in createIfNotExists to
the container root directory.
.
This prevents a TOCTOU attack where a container process swaps a path
component with a symlink between GetResourcePath resolution and
directory/file creation, which could allow writing to arbitrary host
paths outside the container.
Comment:
Cherry-picked from the upstream 25.0 LTS branch (742e28ed8d), which is itself
a backport of master commit 64a22d80b93ddc1416b501b5145df02947312249.
.
The only deviation from the upstream commit is patch context: 26.1.5 carries an
extra "internal/compatcontext" import in daemon/containerfs_linux.go that is not
present on the 25.0 branch, so the import hunk was refreshed to apply at zero
fuzz (dpkg-source rejects any fuzz).
.
NOTE: this patch introduces calls to os.Root.MkdirAll, which requires Go 1.25.
Debian trixie only has Go 1.24, so it is followed immediately by
engine-go1.24-os-root-mkdirall.patch, which replaces those calls with an
equivalent helper built on the Go 1.24 os.Root API.		 Paweł Gronowski <pawel.gronowski@docker.com> not-needed backport, https://github.com/moby/moby/commit/742e28ed8d654372f0aa5b549da74c2f6e674194 2026-08-13
engine-go1.24-os-root-mkdirall.patch build the os.Root security fixes with Go 1.24 The upstream fix for GHSA-vp62-88p7-qqf5 (CVE-2026-41568) rewrites
createIfNotExists() on top of the os.Root API and calls os.Root.MkdirAll().
.
os.Root itself landed in Go 1.24, but the MkdirAll method was only added in
Go 1.25. Debian trixie ships Go 1.24 only (golang-any 2:1.24~2), so the
upstream code as written does not compile there.
.
Replace the two os.Root.MkdirAll() calls with a local mkdirAllInRoot() helper
that walks the path one component at a time using os.Root.Mkdir(), which is
available in Go 1.24. The security property is unchanged: every component is
still created through the *os.Root handle, so the kernel-side scoping that
blocks symlink escapes out of the container root still applies. Error
semantics match os.MkdirAll (success if the path already exists as a
directory, ENOTDIR if it exists as a non-directory).
.
This patch can be dropped once docker.io is built against Go >= 1.25.		 Aron Xu <aron@debian.org> not-needed 2026-08-13
engine-CVE-2026-42306-pin-mount-target-fd.patch Fix bind mount target redirection via symlink swap during docker cp

Pin mount targets via /proc/self/fd file descriptors to prevent TOCTOU
attacks.

Previously, a container process could swap a path component with a
symlink between GetResourcePath resolution and directory/file creation
or mount, allowing writes to arbitrary host paths outside the container.

Open the resolved destination through os.Root to get a pinned fd, then
mount onto /proc/self/fd/<fd> instead of re-resolving the
container-relative path. This closes the TOCTOU window between
createIfNotExists and mount.

Because the kernel rejects remount and propagation-change syscalls on
/proc/self/fd paths, the initial bind mount uses the fd path for safety,
then Readlink resolves the real path for the subsequent read-only
remount and rprivate propagation change.

(cherry picked from commit 43fa458a9c40873867e75221454de10709b04236)		 Paweł Gronowski <pawel.gronowski@docker.com> no 2026-03-26
engine-CVE-2026-42306-resolve-in-container-symlinks.patch daemon: resolve in-container symlinks before os.Root mount ops

The security fix in GHSA-vp62-88p7-qqf5 switched openContainerFS to
os.Root for mount-destination operations, but stopped walking the
destination through in-container symlinks.

os.Root refuses to follow absolute symlinks, so any container whose
image had an absolute symlink along the mount target's path (e.g. the
common /var/run -> /run in ubuntu/alpine/busybox) broke `docker cp`.

Walk m.Destination through ctr.GetResourcePath first which follows
symlinks to get a path relative to BaseFS, then keep using os.Root for
the actual MkdirAll/OpenFile/Open calls.

(cherry picked from commit fb3702d033601bb0e767f2ca398e3909a15be29c)		 Paweł Gronowski <pawel.gronowski@docker.com> no 2026-05-19
buildkit-CVE-2026-33747-validate-container-id.patch executor: validate container IDs centrally BuildKit's gateway API lets a client (e.g. a custom "#syntax" frontend) supply
the container ID that the runc/containerd executor uses. The ID was passed
unvalidated into filepath.Join(w.root, id) to build the OCI bundle path, so an
ID containing path separators or ".." could direct bundle creation outside the
executor root.
.
Add executor.ValidContainerID(), restricting IDs to ASCII letters and digits,
and call it at the top of Run() in both the runc and containerd executors
(moving the "generate an ID if empty" step ahead of the check in the runc
executor so generated IDs are validated too).
.
Per the advisory this is only reachable when a custom BuildKit frontend is in
use (via "#syntax" or --build-arg BUILDKIT_SYNTAX); the well-known
docker/dockerfile frontend is not affected.		 not-needed upstream, extracted from https://github.com/moby/moby/commit/830ddb26a2e437818ffe60fbd28bcb419617df04 2026-08-13
engine-add-go.mod-file.patch Add go.mod file to engine
Fix build issue with
+ github.com/coreos/go-systemd/v22
+ gotest.tools/v3		 Arnaud Rebillout <elboulangero@gmail.com> no 2020-11-24
engine-avoid-hcsshim.patch =================================================================== no
engine-ftbfs-mips.patch Fix FTBFS on mips
===================================================================		 Tianon Gravi <tianon@debian.org> no
engine-backport-48368-netlink-update.patch changes needed for github.com/vishvananda/netlink v1.2.1+
diff --git a/engine/libnetwork/iptables/conntrack.go b/engine/libnetwork/iptables/conntrack.go
index c77993e1055a6..37fd91528a4e0 100644		 no https://github.com/moby/moby/pull/48368
engine-backport-48407-netlink-EINTR.patch changes needed for github.com/vishvananda/netlink v1.2.1+ (retry on EINTR)
diff --git a/engine/daemon/cluster/listen_addr_linux.go b/engine/daemon/cluster/listen_addr_linux.go
index 62e4f61a65..e8e2bddadc 100644		 no https://github.com/moby/moby/pull/48407
engine-CVE-2026-41567-decompress-before-entering-container-fs.patch daemon: Decompress archives before entering container filesystem

Move decompression outside RunInFS to prevent executing
attacker-controlled binaries from within the container filesystem.

When dockerd handles `PUT /containers/{id}/archive`, it switches root
into the container's filesystem before extracting the archive.
Previously, archive.Untar was called inside RunInFS, which meant
decompression binaries (xz, unpigz) were resolved via PATH inside the
container's filesystem. A malicious binary at /usr/bin/xz in the
container would be executed as host root.

Fix by calling decompressing the archive before entering the container
filesystem, then using unpacking the uncompressed tar stream inside
RunInFS.
This ensures decompression binaries are always resolved from the host
filesystem.

(cherry picked from commit 2022313ffe5a8c04890b5295bc52670ee6df8070)		 Paweł Gronowski <pawel.gronowski@docker.com> no 2026-05-18
test--cli-skip-TestSignCommandLocalFlag.patch Skip TestSignCommandLocalFlag
No idea why this test used to pass before and fails now...

~~~~
=== RUN TestSignCommandLocalFlag
--- FAIL: TestSignCommandLocalFlag (35.01s)
sign_test.go:307: assertion failed: expected error to contain "error contacting notary server: dial tcp: lookup reg-name.io",
got "Error: error contacting notary server: dial tcp 125.235.4.59:443: i/o timeout"
...
FAIL github.com/docker/cli/cli/command/trust 49.235s
~~~~


===================================================================		 Arnaud Rebillout <arnaud.rebillout@collabora.com> not-needed vendor, Debian 2019-09-28
test--skip-daemon-oci-linux-pbuilder-tests.patch Skip failing test TestGetSourceMount: "Can't find mount point of /"

===================================================================		 Arnaud Rebillout <elboulangero@gmail.com> not-needed 2020-12-01
test--skip-pkg-system-chtimes-mips64.patch Skip pkg/system chtimes tests on mips64
=== RUN TestChtimesLinux
chtimes_linux_test.go:87: Expected: 2262-04-11 23:47:16 +0000 UTC, got: 1990-01-27 10:50:44 +0000 UTC
--- FAIL: TestChtimesLinux (0.00s)
=== RUN TestChtimes
chtimes_test.go:92: Expected: 2262-04-11 23:47:16 +0000 UTC, got: 1990-01-27 10:50:44 +0000 UTC
--- FAIL: TestChtimes (0.00s)


===================================================================		 Arnaud Rebillout <elboulangero@gmail.com> yes upstream 2021-01-04
test--cli-skip-network-tests.patch cli/command: Skip network tests Interestingly, the last time I tried, only the test
'TestRunBuildFromGitHubSpecialCase' failed, and it failed only
for the armel architecture. Which makes absolutely no sense,
given that it's supposed to fail when there's no network, and
it should have nothing to do with the architecture.
.
Anyway. Let's disable this test.
.
Build error below:
.
=== FAIL: cli/command/image TestRunBuildFromGitHubSpecialCase (0.10s)
Error: unable to prepare context: unable to 'git clone' to temporary context directory: error fetching: fatal: unable to access 'https://github.com/docker/for-win/': Couldn't connect to server
: exit status 128
build_test.go:136: assertion failed: expected error to contain "docker-build-git", got "unable to prepare context: unable to 'git clone' to temporary context directory: error fetching: fatal: unable to access 'https://github.com/docker/for-win/': Couldn't connect to server\n: exit status 128"

===================================================================		 Dmitry Smirnov <onlyjob@debian.org> not-needed 2020-11-27
test--skip-TestGetRootUIDGID.patch disable test failing is sbuild.~~~~
FAIL: TestGetRootUIDGID (0.00s)
idtools_unix_test.go:287:
Error Trace: idtools_unix_test.go:287
Error: Not equal:
expected: 1009
actual : 2952
Test: TestGetRootUIDGID
~~~~

===================================================================		 Dmitry Smirnov <onlyjob@debian.org> not-needed 2018-06-16
test--skip-TestStateRunStop.patch disabled unreliable test.~~~~
state_test.go:102: ExitCode -1, expected 2, err "context deadline exceeded"
~~~~

===================================================================		 Dmitry Smirnov <onlyjob@debian.org> not-needed 2018-08-02
cli-fix-generate-man.patch =================================================================== no
test_invalid_cert_pem.patch TestNewClientWithOpsFromEnv expects different response
=== FAIL: client TestNewClientWithOpsFromEnv/invalid_cert_path (0.00s)
client_test.go:96: assertion failed: expected error "could not load X509 key pair: open invalid/path/cert.pem: no such file or directory", got "Could not load X509 key pair: open invalid/path/cert.pem: no such file or directory"
open invalid/path/cert.pem: no such file or directory
Could not load X509 key pair
github.com/docker/go-connections/tlsconfig.getCert
/<<PKGBUILDDIR>>/_build/src/github.com/docker/go-connections/tlsconfig/config.go:183
github.com/docker/go-connections/tlsconfig.Client
/<<PKGBUILDDIR>>/_build/src/github.com/docker/go-connections/tlsconfig/config.go:216
github.com/docker/docker/client.FromEnv.WithTLSClientConfigFromEnv.func1
/<<PKGBUILDDIR>>/_build/src/github.com/docker/docker/client/options.go:174
github.com/docker/docker/client.FromEnv
/<<PKGBUILDDIR>>/_build/src/github.com/docker/docker/client/options.go:40
github.com/docker/docker/client.NewClientWithOpts
/<<PKGBUILDDIR>>/_build/src/github.com/docker/docker/client/client.go:201
github.com/docker/docker/client.TestNewClientWithOpsFromEnv.func1
/<<PKGBUILDDIR>>/_build/src/github.com/docker/docker/client/client_test.go:94
testing.tRunner
/usr/lib/go-1.22/src/testing/testing.go:1689
runtime.goexit
/usr/lib/go-1.22/src/runtime/asm_amd64.s:1695

===================================================================		 Reinhard Tartler <siretart@tauware.de> no
test-disable-tests-that-require-root.patch Disable tests that assume we run as root
===================================================================		 Reinhard Tartler <siretart@tauware.de> no
test-docker-pull-error.patch String mismatch
=== FAIL: distribution TestPullSchema2Config/unauthorized (0.00s)
pull_v2_test.go:302: HTTP GET /v2/
pull_v2_test.go:302: HTTP GET /v2/docker.io/library/testremotename/blobs/sha256:66ad98165d38f53ee73868f82bd4eed60556ddfee824810a4062c4f777b20a5b
pull_v2_test.go:332: expected error="download failed after attempts=1: unauthorized: authentication required" to contain "unauthorized: you need to be authenticated"


===================================================================		 Reinhard Tartler <siretart@tauware.de> no
test--cli-fix-string-issues.patch fix minor string issues in cli unit-test
===================================================================		 Badrikesh Prusty <badrikesh.prusty@siemens.com> no
test--cli-TestInitializeFromClientHangs.patch Not suitable for package tests
===================================================================		 Reinhard Tartler <siretart@tauware.de> no
test--cli-TestUseHostOverrideEmpty.patch Not suitable for package tests
===================================================================		 Reinhard Tartler <siretart@tauware.de> no
test--cli-TestCloseRunningCommand.patch Not suitable for package tests
===================================================================		 Reinhard Tartler <siretart@tauware.de> no
grpc-middleware-v1.patch copy grpc-middleware v1 Shengjing Zhu <zhsj@debian.org> not-needed 2024-08-13
buildkit-remove-hcsshim.patch =================================================================== no
buildkit-remove-jaeger.patch =================================================================== no
debian-bash-completion-no-shebang.patch Remove shebang from bash completion file Discussed upstream, rejected as most code editors rely on the shebang
to correctly indent and highlight the file.

===================================================================		 Arnaud Rebillout <elboulangero@gmail.com> yes 2020-11-27
debian-systemd-unit-environment-file.patch Use EnvironmentFile with the systemd unit file.
===================================================================		 Paul R. Tagliamonte <paultag@debian.org> no debian 2014-05-07
debian-dockerd-binary-location.patch FHS compliance.
===================================================================		 not-needed
debian-nuke-no-prompt.patch remove prompt and delay
===================================================================		 Dmitry Smirnov <onlyjob@debian.org> not-needed debian 2018-06-09
cli-add-go.mod-file.patch Add go.mod file to cli
Fix build issue during tests with
+ gotest.tools/v3		 Arnaud Rebillout <elboulangero@gmail.com> no 2020-11-24
buildkit-CVE-2026-33748-git-subdir-symlink-escape.patch git: normalize and validate subdir paths BuildKit's Git source handler accepts a "#ref:subdir" fragment on a Git build
context URL. Before this fix the subdir was only run through path.Clean() and
then opened with os.Open(filepath.Join(checkoutDir, subdir)), with no check
that each path segment is a real directory inside the checkout. A malicious
repository could therefore make the subdir (or an intermediate segment) a
symlink and have BuildKit read files from outside the checked-out repository.
.
This is reachable from "docker build <git-url>#<ref>:<subdir>" via dockerd's
embedded BuildKit builder; a standalone buildkitd is not required.		 not-needed backport, derived from https://github.com/moby/moby/commit/830ddb26a2e437818ffe60fbd28bcb419617df04 2026-08-13

All known versions for source package 'docker.io'

Links