CVE-2026-78408
Util-linux: util-linux: nsenter --join-cgroup leaks root cgroup migration authority
- Published
- Updated
- Reserved
- Assigned by
- redhat
Description
The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes.
Public exploit
A reference of the record is tagged as an exploit or proof of concept: anyone can try it against an unpatched system. CISA's SSVC rates its exploitation: a proof of concept is public.
Timeline
ID reserved
By redhat
- 9 days later
· 9 days later
Published
- 2 months later
· 2 months later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| redhatCNA (assigner) | 3.1 | High7.9 | CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H |
| NVDNVD · Awaiting Analysis | 3.1 | High7.9 | CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H |
- EPSS (exploitation in 30 days)
- 0.24% · top 85% of all CVEs (7 Nov 2026)
- CISA SSVC
- Exploitation: poc · Automatable: no · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.9.
Weakness
Affected products
Red Hat · Red Hat Enterprise Linux 10
- unaffected 0:2.40.2-18.el10_2.20 – < *
Red Hat · Red Hat Cost Management On-Premise 1
- unaffected 1793825318 – < *
Red Hat · Red Hat Hardened Images
- unaffected 2.42.2-3.4.hum1 – < *
Red Hat · Red Hat Enterprise Linux 7
All versions: unaffected
Red Hat · Red Hat Enterprise Linux 8
All versions: unaffected
Red Hat · Red Hat Enterprise Linux 9
All versions: unaffected
Red Hat · Red Hat Enterprise Linux 9
All versions: unaffected
Red Hat · Red Hat Enterprise Linux 9
All versions: unaffected
Red Hat · Red Hat OpenShift Container Platform 4
All versions: unaffected
Red Hat · Red Hat OpenShift Container Platform 4
All versions: unaffected
Red Hat · Red Hat OpenShift Container Platform 5
All versions: unaffected
What to do
Workaround: Upgrade to util-linux v2.41.6, v2.42.3, or later. Until a fix is applied, do not run nsenter --join-cgroup (including nsenter --target PID --all --join-cgroup) against untrusted processes or namespaces. The fix closes the cgroup.procs descriptor immediately after joining, and opens it with O_CLOEXEC.
References (7)
- RHSA-2026:63162 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
- RHSA-2026:93461 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
- RHSA-2026:95365 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/security/cve/CVE-2026-78408 (opens in a new tab)vdb-entryx_refsource_REDHAT
- RHBZ#2522497 (opens in a new tab)issue-trackingx_refsource_REDHAT
- https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj (opens in a new tab)exploit
- http://www.openwall.com/lists/oss-security/2026/09/05/2 (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2026-78408)Record last updated .