CVE-2026-80929

Received Received - Intake

Privilege Escalation in Linux Kernel via sysctl

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: sysctl: move the "cad_pid" entry from pid_table[] to kern_reboot_table[] cad_pid is global, and kill_cad_pid() is only used in the root namespace. However, due to pid_table_root_permissions(), a non-root user can unshare pid/user namespaces and modify it from the child namespace. This makes no sense and is simply wrong. Move it to kern_reboot_table[] where it logically belongs; this ensures that only GLOBAL_ROOT_UID can read/modify this sysctl. Note that this patch doesn't preserve "#ifdef CONFIG_PROC_SYSCTL" around the "cad_pid"; CONFIG_PROC_SYSCTL selects CONFIG_SYSCTL, so it is always set when kern_reboot_table[] is compiled.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-11

Generated

2026-09-12

AI Q&A

2026-09-12

EPSS Evaluated

N/A

NVD

CVE-2026-80929

EUVD

EUVD-2026-76252

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a misplaced sysctl entry called cad_pid. It was incorrectly placed in pid_table[] but should be in kern_reboot_table[]. Due to this, a non-root user could unshare pid/user namespaces and modify cad_pid from a child namespace, which is incorrect behavior since cad_pid is global and only kill_cad_pid() should use it in the root namespace.

The fix moves cad_pid to kern_reboot_table[] to ensure only users with GLOBAL_ROOT_UID can read or modify it.

Detection Guidance

This vulnerability is specific to the Linux kernel's sysctl handling of cad_pid. Detection requires checking kernel version and sysctl configurations. Use 'uname -r' to check kernel version and 'sysctl -a | grep cad_pid' to verify if cad_pid is exposed in pid_table.

Impact Analysis

This vulnerability could allow a non-root user to manipulate system reboot behavior by modifying cad_pid from an unshared namespace. This might lead to unexpected system reboots or denial of service if misused.

Mitigation Strategies

Apply the kernel patch that moves cad_pid to kern_reboot_table. Update to a patched kernel version. Restrict unprivileged user access to pid/user namespaces via kernel parameters like 'kernel.unprivileged_userns_clone=0'.

Hi! I’m here to help you understand CVE-2026-80929. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70