CVE-2026-54727: Container Isolation Bypass in proot-distro via Malicious Restore Archive

The vulnerability designated as CVE-2026-54727 is a container isolation bypass in proot-distro before version 5.1.6. This utility manages PRoot-based rootless Linux distributions on Termux. Because all containers in this environment execute under the context of the same Termux Unix user ID, they share physical host permissions. The security boundary between containers is primarily maintained by path segregation within the application logic.

During the execution of the restore command, proot-distro extracts user-provided backup tarballs. Prior to version 5.1.6, the extraction engine failed to ensure that hardlink targets resolved exclusively within the specific container being restored. This omission allowed a malicious or compromised container archive to reference resources belonging to other separate containers, undermining the intended tenant isolation model.

The root cause lies in how the proot-distro restore process parsed TAR archive files containing hardlinks (tarfile.LNKTYPE). When the Python tarfile module or helper functions extract a hardlink, they resolve the target path indicated by the linkname property relative to the working directory. While proot-distro restricted links from escaping the overall directory containing all containers, it did not enforce isolation at the individual container level.

Specifically, the program did not cross-reference the container name extracted from the destination path with the container name defined in the link's source. If the destination was set to attacker-container/rootfs/... and the link's target path was ../victim-container/rootfs/..., the underlying OS hardlink call would succeed because both paths were owned by the same Termux user ID.

Additionally, a secondary input validation weakness existed in the name validation regex defined in names.py. The expression re.compile(r"^[A-Za-z0-9][A-Za-z0-9_.\-]*$") used the $ anchor instead of \Z. In Python, the $ anchor permits a trailing newline character (\n) at the end of the validated string. This enabled the creation of container names containing hidden control characters, which could lead to command injection or filesystem state confusion during path rendering.

The fix for CVE-2026-54727 was implemented across several commits to enforce strict container boundaries. Commit 98aff324b7d8500ff75a8ca9ac087ee636be4716 introduced hardlink target verification during the extraction process. The following diff demonstrates how the target container name of a hardlink is extracted and validated against the active container restoration context:

# Mitigation: Enforcing that hardlink sources match the active container
link_container, link_src = _dest_path(member.linkname)
if link_src is None or link_container != restore_name:
    # Skip hardlinks pointing outside the target container
    continue

Additionally, the container name validation was hardened in commit eb1dbf8d204c8cb494e8787b935d170a802675d5 by changing the end-of-string match anchor to prevent trailing newline bypasses:

# Patched pattern using \Z
_NAME_RE = re.compile(r"^[A-Za-z0-9][A-Za-z0-9_.\-]*\Z")

Commit 6f73f98330b576dfc6863b9c5ad5043d043c8609 also added a helper _is_rootfs_dest to verify that the target directory resolves to the expected rootfs location of the current container. This prevents files from overwriting metadata files or other internal files during extraction.

An attacker can exploit this flaw by constructing a TAR archive that masquerades as a legitimate container backup. The archive contains a manifest.json file configuring a target container named attacker-box and a matching directory structure under attacker-box/rootfs/. To bridge the isolation boundary, the attacker inserts a hardlink record (tarfile.LNKTYPE) into the archive stream.

The hardlink maps a source entry inside attacker-box/rootfs/sensitive to a target file located in an unrelated container directory, such as ../victim-box/rootfs/etc/shadow. Since the extractor does not check if the prefix of the resolved target matches attacker-box, the extraction utility calls os.link(). This creates a direct reference link to the victim container's sensitive file, giving the attacker read and write access to the target file when they interact with attacker-box.

The CVSS score of 8.2 (High) reflects the severity of this container containment failure. The vulnerability scores High for Confidentiality and Integrity impacts because an attacker can gain arbitrary read and write access to any file inside other isolated containers managed by the same Termux installation. If the victim container runs databases, local configuration stores, or cryptographic keys, these assets are fully compromised.

The Attack Vector is Local (AV:L) because the victim must be enticed to run the proot-distro restore command on an untrusted archive. This makes social engineering or supply-chain delivery of malicious container configurations the primary threat vectors. The Scope is Changed (S:C) because a vulnerability in the restore engine of one container breaches the integrity and confidentiality boundaries of other tenant environments.

The primary remediation for CVE-2026-54727 is updating proot-distro to version 5.1.6 or later. This release enforces single-container restore boundaries, checks the validity of extraction paths, and restricts hardlinks to their respective container roots. The package can be updated using the Termux package manager.

In environments where immediate updates are not feasible, administrators should refrain from restoring third-party or untrusted container backup archives. System integrators should audit existing backup files by executing command-line inspections. Inspecting the archive contents before executing a restore will reveal if any hardlink or symlink members attempt to traverse out of the target directory structure.

tar -tvf container_backup.tar.gz | grep -E "-> \.\./"