What’s Vulnerable › Vulnerabilities

CVE-2026-78408: Util-linux: util-linux: nsenter --join-cgroup leaks root cgroup migration authority

• Severity: high (CVSS 7.9 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-02 · updated 2026-10-30
• Weakness: CWE-775

Description

The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes.

Affected products

• Red Hat Enterprise Linux 10: all versions
• Red Hat Hardened Images: all versions — fixed in 2.42.2-3.4.hum1

How to fix

Upgrade to a fixed version: Red Hat Hardened Images 2.42.2-3.4.hum1. Check the vendor advisory for mitigations.

References

• https://access.redhat.com/errata/RHSA-2026:63162
• https://access.redhat.com/security/cve/CVE-2026-78408
• https://bugzilla.redhat.com/show_bug.cgi?id=2522497
• https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj
• http://www.openwall.com/lists/oss-security/2026/09/05/2
• https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj

Get alerted when CVE-2026-78408 or the next vulnerability affects your stack