Description
The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | — | — |
| Red Hat | Red Hat Cost Management On-Premise 1 | — | — |
| Red Hat | Red Hat Hardened Images | — | — |
| Red Hat | Red Hat Enterprise Linux 7 | — | — |
| Red Hat | Red Hat Enterprise Linux 8 | — | — |
| Red Hat | Red Hat Enterprise Linux 9 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 5 | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | util-linux | 2.42.4-1 | — |
| Debian 13 | util-linux | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | util-linux | No fix yet | — |
| Ubuntu 26.04 LTS | util-linux | No fix yet | — |
| Ubuntu 18.04 LTS | util-linux | No fix yet | — |
| Ubuntu 14.04 LTS | util-linux | No fix yet | — |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 20.04 LTS | util-linux | No fix yet | — |
| Ubuntu Pro 16.04 LTS | util-linux | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Hardened Images 1 | uuidd +17 | 2.42.2-3.4.hum1 | RHSA-2026:63162 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | uuidd +13 | 2.40.2-18.el10_2.20 | ALSA-2026:93461 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | util-linux | 2.40.2-18.el10_2.20 | RLSA-2026:93461 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 16.0 | util-linux +2 | 2.41.1-160000.5.1 | SUSE-SU-2026:23870-1, SUSE-SU-2026:23861-1 |
| SLES 16.0 | util-linux +2 | 2.41.1-160000.5.1 | SUSE-SU-2026:23870-1, SUSE-SU-2026:23861-1 |
| SLE Micro 6.2 | util-linux +1 | 2.41.1-160000.5.1 | SUSE-SU-2026:23884-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | util-linux | 2.42.3-1.1 | openSUSE-SU-2026:11870-1 |
| openSUSE Leap 16.0 | util-linux +2 | 2.41.1-160000.5.1 | openSUSE-SU-2026:21905-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | util-linux | 2.42.3-r1 | — |
| Alpine v3.23 | util-linux | 2.41.6-r1 | — |
| Alpine v3.22 | util-linux | 2.41.6-r1 | — |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | util-linux | 2.40.2-6 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 10 | uuidd +13 | 2.40.2-18.0.1.el10_2.20 | ELSA-2026-93461 |
Advisories 9
- RLSA-2026:93461 Important: util-linux security update Rocky Linux Security Advisories · Nov 3, 2026
- ALSA-2026:93461 Important: util-linux security update AlmaLinux Security Advisories · Nov 2, 2026
- ELSA-2026-93461 Important: util-linux security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Nov 2, 2026
- RHSA-2026:63162 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Oct 17, 2026
- SUSE-SU-2026:23884-1 Security update for util-linux SUSE / openSUSE Security Updates · Sep 30, 2026
- SUSE-SU-2026:23870-1 Security update for util-linux SUSE / openSUSE Security Updates · Sep 27, 2026
- SUSE-SU-2026:23861-1 Security update for util-linux SUSE / openSUSE Security Updates · Sep 27, 2026
- openSUSE-SU-2026:21905-1 Security update for util-linux SUSE / openSUSE Security Updates · Sep 25, 2026
- openSUSE-SU-2026:11870-1 libblkid-devel-2.42.3-1.1 on GA media SUSE / openSUSE Security Updates · Sep 24, 2026
References
- RHSA-2026:63162 vendor-advisory
- RHSA-2026:93461 vendor-advisory
- RHSA-2026:95365 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2026-78408 vdb-entry
- RHBZ#2522497 issue-tracking
- https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj