NotCVE-2025-0003

Kubernetes releases compiled with vulnerable Go versions (prior to Go 1.21.11 / 1.22.4) are affected by a race condition in the os.RemoveAll function used during volume cleanup. A malicious container can exploit this by timing a symbolic link replacement to redirect the deletion operation outside the intended volume path. This can result in deletion of arbitrary files or directories on the host system, including data from other pods or host volumes, leading to data loss and potential privilege escalation.

This NotCVE is distinct from the Go NotCVE-2025-0004 because:

- Kubernetes embeds the vulnerable Go code,
- Exposes it in a privileged execution context (volume cleanup),
- And provides a defined remediation path (rebuild with fixed Go).