New runc vulnerabilities allow container escape: CVE-2025-31133, CVE-2025-52565, CVE-2025-52881

This Sysdig Threat Research Team advisory (Nov 5, 2025) details three runc vulnerabilities that enable container escape and arbitrary /proc writes via maskedPaths symlink abuse, /dev/console mount races, and shared-mount race conditions leading to LSM bypass; it lists affected and fixed runc versions, provides detection guidance (experimental Falco rule), and recommends immediate mitigations including upgrading runc, enabling user namespaces, and using rootless containers.