CVE-2026-24054: The Bind-Mount That Convinced Kata to Hotplug Your Host Disk

A malformed or layer-less container image makes containerd fall back to a bind-mount of an empty snapshotter directory. Kata's "is this rootfs a block device?" heuristic dutifully walked up from that empty directory, hit the host's actual root block device, and politely passed it through to the guest VM — where the guest and the host then proceeded to corrupt the same filesystem in stereo.