CVE-2026-18107
Received Received - Intake

Privilege Escalation in CRIU via Rseq Spoofing

Publication date: 2026-07-28

Last updated on: 2026-07-28

Assigner: Red Hat, Inc.

Description
A flaw was found in CRIU's handling of restartable sequences (rseq) during checkpoint/restore. A malicious process inside a container can register an rseq critical section that hijacks CRIU's parasite code injection during checkpoint, allowing it to spoof the process credentials saved in the checkpoint image. On restore, the container process gains elevated capabilities and zeroed UIDs/GIDs. The practical impact on Red Hat products is limited by several factors: checkpoint/restore requires root privileges (podman) or cluster-admin RBAC (OpenShift) to trigger and cannot be initiated from within the container itself; on OpenShift prior to 4.17 the feature required explicit opt-in, and on 4.17+ the kubelet checkpoint API RBAC is not configured by default; OpenShift enforces user namespaces by default for regular workloads (hostUsers is gated behind admin-only SCCs), which makes the spoofed capabilities namespace-scoped and ineffective for privilege escalation; SELinux type enforcement (container_t) blocks privilege transitions independently of capabilities; seccomp filters persist through checkpoint/restore and cannot be corrupted via the parasite; and kernel mount namespace ownership checks on RHEL 9/10 kernels prevent mount-based container escape even with spoofed capabilities.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-28
Last Modified
2026-07-28
Generated
2026-07-29
AI Q&A
2026-07-28
EPSS Evaluated
N/A
NVD
CVE-2026-18107
EUVD
EUVD-2026-49986

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
red_hat openshift to 4.17 (exc)
red_hat podman *
red_hat criu *
checkpoint_restore criu *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-269 The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-18107 is a flaw in CRIU's handling of restartable sequences (rseq) during checkpoint/restore operations. An attacker inside a container can register a malicious rseq critical section that hijacks CRIU's parasite code injection during checkpoint. This allows the attacker to spoof process credentials saved in the checkpoint image, granting elevated capabilities and zeroed UIDs/GIDs during restore.

Detection Guidance

Detection requires monitoring for unusual checkpoint/restore operations or rseq critical section hijacking attempts. Check CRIU logs for failed or suspicious checkpoint/restore events. Use system auditing tools like auditd to track ptrace calls targeting critical processes. Inspect container runtime configurations for unauthorized checkpoint permissions.

Impact Analysis

The impact is limited in Red Hat products. Exploiting this requires root privileges (podman) or cluster-admin RBAC (OpenShift) to trigger checkpoint/restore. On OpenShift prior to 4.17, explicit opt-in was needed, and on 4.17+ the feature is not configured by default. User namespaces, SELinux, seccomp filters, and kernel mount namespace checks further mitigate the risk of privilege escalation or container escape.

Compliance Impact

The vulnerability's impact on compliance with standards like GDPR or HIPAA is limited due to mitigating factors. The attack requires root privileges or cluster-admin RBAC to trigger, which restricts unauthorized access. OpenShift's default configurations and SELinux enforcement further reduce the risk of privilege escalation or data breaches that could violate compliance requirements.

Mitigation Strategies

Apply the latest CRIU patches from upstream or your distribution. Disable checkpoint/restore capabilities for untrusted containers. Restrict ptrace access via kernel.yama.ptrace_scope. Ensure SELinux and seccomp policies are enforced. Update OpenShift clusters to 4.17+ and disable legacy checkpoint opt-in features.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-18107. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart