Affected by GO-2025-4100
and 7 other vulnerabilities
GO-2025-4100: containerd affected by a local privilege escalation via wide permissions on CRI directory in github.com/containerd/containerd
GO-2025-4108: containerd CRI server: Host memory exhaustion through Attach goroutine leak in github.com/containerd/containerd
GO-2026-5064: containerd CRI checkpoint restore CDI annotation smuggling in github.com/containerd/containerd
GO-2026-5338: containerd: CRI checkpoint import allows local image tag poisoning in github.com/containerd/containerd
GO-2026-5378: containerd user ID handling bypass allows runAsNonRoot evasion in github.com/containerd/containerd
GO-2026-5475: containerd image-triggered runtime DoS via unbounded group parsing in github.com/containerd/containerd
GO-2026-5622: Arbitrary host CRI log file read via symlink following in CRI checkpoint restore in github.com/containerd/containerd
GO-2026-5758: containerd CRI — image-config `LABEL` flows to restart-monitor `binary://` logger: host-root command execution from an image pull in github.com/containerd/containerd
NewWalkingDiff is a generic implementation of diff.Comparer. The diff is
calculated by mounting both the upper and lower mount sets and walking the
mounted directories concurrently. Changes are calculated by comparing files
against each other or by comparing file existence between directories.
NewWalkingDiff uses no special characteristics of the mount sets and is
expected to work with any filesystem.