CVE-2026-78408
Util-linux: util-linux: nsenter --join-cgroup leaks root cgroup migration authority
CVSS Score
7.9
EPSS Score
0.0%
EPSS Percentile
0th
The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes.
| CWE | CWE-775 |
| Vendor | red hat |
| Product | red hat hardened images |
| Published | Sep 2, 2026 |
| Last Updated | Sep 5, 2026 |
Stay Ahead of the Next One
Get instant alerts for red hat red hat hardened images
Be the first to know when new high vulnerabilities affecting red hat red hat hardened images are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
Required
Scope
Changed
Confidentiality
None
Integrity
High
Availability
High
Affected Versions
Red Hat / Red Hat Hardened Images
All versions affected Red Hat / Red Hat Enterprise Linux 10
All versions affected Red Hat / Red Hat Enterprise Linux 7
All versions affected Red Hat / Red Hat Enterprise Linux 8
All versions affected Red Hat / Red Hat Enterprise Linux 9
All versions affected Red Hat / Red Hat Enterprise Linux 9
All versions affected Red Hat / Red Hat Enterprise Linux 9
All versions affected Red Hat / Red Hat OpenShift Container Platform 4
All versions affected References
access.redhat.com: https://access.redhat.com/errata/RHSA-2026:63162 access.redhat.com: https://access.redhat.com/security/cve/CVE-2026-78408 bugzilla.redhat.com: https://bugzilla.redhat.com/show_bug.cgi?id=2522497 github.com: https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj openwall.com: http://www.openwall.com/lists/oss-security/2026/09/05/2
Credits
Red Hat would like to thank Andreas Gabriel Berbescu (Independent Security Researcher) for reporting this issue.