There is an updated pull request by CameronNemo against master on the void-packages repository

https://github.com/CameronNemo/void-packages master
https://github.com/void-linux/void-packages/pull/18526

runc: update to 1.0.0rc9.
Fix CVE-2019-19921

See https://github.com/opencontainers/runc/issues/2197

A patch file from https://github.com/void-linux/void-packages/pull/18526.patch is attached