Data exposure via mount policy mismatch

Mount validation flaw in Kata Containers for Red Hat OpenShift Container Platform allows authenticated attackers to expose or inject data via CreateContainer requests. In genpolicy, the Rego allow_mount and allow_storage rules treated image_guest_pull storages and emptyDir-style mounts as equivalent, so attacker-supplied CreateContainer mount and storage entries could satisfy trusted policy checks without validating an expected rootfs path or legitimate block-storage source. Exposure is limited to Confidential Containers deployments that use genpolicy to protect the guest from the host; Kata sandboxing is not affected, but a malicious host operator can remap rootfs paths onto trusted locations such as service-account mounts or seed attacker-controlled content in guest paths such as /dev/shm and /dev/termination-log.