proot-distro is a utility for managing proot containers. Prior to version 5.1.6, proot-distro restore accepted hardlink entries whose linkname referenced anothe…

CVE-2026-54727 affects proot-distro, a utility for managing proot containers on Android/Termux environments. Prior to version 5.1.6, the restore functionality accepted hardlink entries without verifying that the hardlink source container matched the destination container being restored. This flaw allowed a crafted restore archive to copy files between otherwise isolated containers, breaking container isolation. The vulnerability could be exploited by an attacker who can supply a malicious restore archive. The issue has been patched in proot-distro version 5.1.6. Users are advised to update immediately to mitigate the risk of cross-container file access.