Jobs in privileged containers break unprivileged jobs

Describe the bug
In an organization setting, after a runner executes a job which executes actions in a privileged container, that runner will be unable to execute jobs which do not use privileged containers. Instead, the unprivileged job will fail with a permissions error while attempting to clean up the runner's _work/_actions directory.

This issue began with the release of v2.336.0 of the runner.

To Reproduce
Steps to reproduce the behavior:

1. In an organization, create a self-hosted Linux runner.
2. Create two repositories (I'm not completely certain this step is necessary).
   • unprivileged-repo
   • privileged-repo
3. In unprivileged-repo, place unprivileged.yml in the .github/workflows directory.
4. In privileged-repo, place privileged.yml in the .github/workflows directory.
5. Create the secrets DOCKER_HUB_USERNAME and DOCKER_HUB_PASSWORD with valid docker hub credentials. (Necessary for this demonstration.)
6. In unprivileged-repo, execute the workflow named "Regular Workflow". It will execute successfully.
7. In privileged-repo, execute the workflow named "Privileged Workflow". It will fail due to issues with the image. This is expected.
8. Return to unprivileged-repo and attempt to execute the "Regular Workflow" again.
9. The workflow will fail with the following message:

One or more errors occurred. (Access to the path '<<RUNNER_BASE>>/_work/_actions/docker/scout-action/5f152f0e27fe61208acd7c71966aec13ace3e3c7/dist/docker-scout-action_linux_amd64' is denied.)

Expected behavior
I expected the ability to run an unprivileged workflow to be unaffected by the execution of other workflows.

Runner Version and Platform

Version of your runner? 2.336.0

OS of the machine running the runner? OSX/Windows/Linux/...

• The first occurrence was observed in Oracle Linux Server 8.10.
• It has been reproduced in Ubuntu 24.04.4 LTS.

What's not working?

Please include error messages and screenshots.

Job Log Output

If applicable, include the relevant part of the job / step log output here. All sensitive information should already be masked out, but please double-check before pasting here.

From the privileged job, note the binary's directory path.

26-07-31T17:20:26.6999255Z ##[command]/usr/bin/docker exec  31eea4f6aefb76d6931268391d7fcaffc4e244e7d647936d9e189d9cef8ca6d4 sh -c "cat /etc/*release | grep ^ID"
2026-07-31T17:20:27.3452684Z Downloading asset: docker-scout-action_linux_amd64 (179.2 MB)
2026-07-31T17:20:42.6326559Z Using binary: /__w/_actions/docker/scout-action/5f152f0e27fe61208acd7c71966aec13ace3e3c7/dist/docker-scout-action_linux_amd64
2026-07-31T17:20:43.2653509Z ##[group]cves
2026-07-31T17:20:44.4469873Z     ✓ SBOM obtained from attestation, 17 packages found
2026-07-31T17:20:44.4494720Z     ✓ Provenance obtained from attestation
2026-07-31T17:20:45.7927117Z     ✓ Loaded 0 VEX documents

The failed job's log. Note the path where access was denied.

2026-07-31T17:21:51.1074577Z Current runner version: '2.336.0'
2026-07-31T17:21:51.1086022Z Runner name: 'traveler'
2026-07-31T17:21:51.1087252Z Runner group name: 'default'
2026-07-31T17:21:51.1088562Z Machine name: 'traveler'
2026-07-31T17:21:51.1093521Z ##[group]GITHUB_TOKEN Permissions
2026-07-31T17:21:51.1097402Z Contents: read
2026-07-31T17:21:51.1098240Z Metadata: read
2026-07-31T17:21:51.1099210Z Packages: read
2026-07-31T17:21:51.1100044Z ##[endgroup]
2026-07-31T17:21:51.1104025Z Secret source: Actions
2026-07-31T17:21:51.1105587Z Prepare workflow directory
2026-07-31T17:21:51.1892621Z ##[error]One or more errors occurred. (Access to the path '/home/blair/gho-runner/_work/_actions/docker/scout-action/5f152f0e27fe61208acd7c71966aec13ace3e3c7/dist/docker-scout-action_linux_amd64' is denied.)

Runner and Worker's Diagnostic Logs

If applicable, add relevant diagnostic log information. Logs are located in the runner's _diag folder. The runner logs are prefixed with Runner_ and the worker logs are prefixed with Worker_. Each job run correlates to a worker log. All sensitive information should already be masked out, but please double-check before pasting here.

Diagnostic log for the failed unprivileged workflow

Worker_20260731-172150-utc.log

Diagnostic log for the privileged workflow

Worker_20260731-172016-utc.log

Unprivileged workflow

unprivileged.yml

Privileged workflow

privileged.yml

Start by comparing the attached privileged.yml and unprivileged.yml workflows with the two Worker diagnostic logs, focusing on the _work/_actions path and the cleanup failure after the privileged container runs. Trace the runner's cleanup behavior for that directory; done means a privileged workflow no longer prevents a later unprivileged workflow from completing.