Util-linux: util-linux: nsenter --join-cgroup leaks root cgroup migration authority
Summary
| CVE | CVE-2026-78408 |
|---|---|
| State | PUBLISHED |
| Assigner | redhat |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-09-02 16:17:23 UTC |
| Updated | 2026-09-04 03:17:42 UTC |
| Description | The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes. |
Risk And Classification
Primary CVSS: v3.1 7.9 HIGH from [email protected]
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H
EPSS: 0.001120000 probability, percentile 0.014840000 (date 2026-09-03)
Problem Types: CWE-775 | CWE-775 Missing Release of File Descriptor or Handle after Effective Lifetime
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | [email protected] | Secondary | 7.9 | HIGH | CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H |
| 3.1 | CNA | CVSS | 7.9 | HIGH | CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H |
CVSS v3.1 Breakdown
Attack Vector
LocalAttack Complexity
LowPrivileges Required
LowUser Interaction
RequiredScope
ChangedConfidentiality
NoneIntegrity
HighAvailability
HighCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Red Hat | Red Hat Hardened Images | unaffected 2.42.2-3.4.hum1 * rpm | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 10 | Not specified | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 7 | Not specified | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 8 | Not specified | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 9 | Not specified | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 9 | Not specified | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 9 | Not specified | Not specified |
| CNA | Red Hat | Red Hat OpenShift Container Platform 4 | Not specified | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| bugzilla.redhat.com/show_bug.cgi | [email protected] | bugzilla.redhat.com | |
| access.redhat.com/errata/RHSA-2026:63162 | [email protected] | access.redhat.com | |
| access.redhat.com/security/cve/CVE-2026-78408 | [email protected] | access.redhat.com | |
| github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | github.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: Red Hat would like to thank Andreas Gabriel Berbescu (Independent Security Researcher) for reporting this issue. (en)
Additional Advisory Data
| Source | Time | Event |
|---|---|---|
| CNA | 2026-07-26T09:22:21.000Z | Reported to Red Hat. |
| CNA | 2026-09-02T00:00:00.000Z | Made public. |
Workarounds
CNA: Upgrade to util-linux v2.41.6, v2.42.3, or later. Until a fix is applied, do not run nsenter --join-cgroup (including nsenter --target PID --all --join-cgroup) against untrusted processes or namespaces. The fix closes the cgroup.procs descriptor immediately after joining, and opens it with O_CLOEXEC.
There are currently no legacy QID mappings associated with this CVE.