runc procfs write redirection and LSM bypass

CVE-2025-52881 is a race-condition vulnerability in runc, the OCI container runtime, that allows an attacker to trick runc into redirecting writes intended for procfs files to unintended procfs targets. The issue affects runc 1.2.7, 1.3.2, and 1.4.0-rc.2, and broader reporting describes it as affecting all known versions prior to the fixed releases. Exploitation relies on a racing container with shared mounts so that, during runc's handling of writes to /proc, the attacker can cause path resolution to be redirected via symlinks in tmpfs or potentially bind mounts. The flaw is particularly relevant to writes associated with Linux Security Module relabeling and sysctl handling. The vulnerability is described as a more sophisticated variant of CVE-2019-19921 because the earlier mitigation only verified that certain LSM-label writes targeted procfs, which was insufficient to prevent redirected-write abuse. Successful exploitation can transform ordinary runc writes into attacker-controlled writes to sensitive procfs files such as /proc/sysrq-trigger or /proc/sys/kernel/core_pattern.