CVE-2026-78408
Received Received - Intake

nsenter --join-cgroup Privilege Escalation in Linux

Publication date: 2026-09-02

Last updated on: 2026-09-02

Assigner: redhat-SADP

Description
The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-02
Last Modified
2026-09-02
Generated
2026-09-02
AI Q&A
2026-09-02
EPSS Evaluated
N/A
NVD
CVE-2026-78408
EUVD
EUVD-2026-70105

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
util-linux util-linux From 2.40 (inc) to 2.42.2 (inc)
util-linux util-linux 2.41.6
util-linux util-linux 2.42.3

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-775 The product does not release a file descriptor or handle after its effective lifetime has ended, i.e., after the file descriptor/handle is no longer needed.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-78408 is a vulnerability in the util-linux package affecting versions 2.40 through 2.42.2. The issue involves the nsenter --join-cgroup command, which opens the target cgroup v2 cgroup.procs file while running as root, writes its own PID to join the cgroup, and leaves the file descriptor open during subsequent namespace and credential transitions. The file descriptor is not closed or marked with O_CLOEXEC, allowing the process to retain root's cgroup-migration authority even after dropping privileges.

Detection Guidance

Check util-linux version with 'nsenter --version' or 'dpkg -l util-linux'. If version is between 2.40 and 2.42.2, the system is vulnerable. Look for processes using nsenter --join-cgroup against untrusted targets. Check for unexpected cgroup migrations or process terminations in logs.

Impact Analysis

An attacker could exploit this to migrate and terminate unrelated root processes after a privileged operator uses nsenter --join-cgroup against an attacker-controlled target. This could lead to denial of service or system instability by terminating critical system processes.

Mitigation Strategies

Upgrade util-linux to v2.41.6, v2.42.3, or later. Avoid running 'nsenter --join-cgroup' against untrusted processes or namespaces. Monitor for suspicious cgroup activities and terminate any unauthorized processes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-78408. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart