CVE-2026-80929

Received Received - Intake

Privilege Escalation in Linux Kernel via sysctl

Publication date: 2026-09-11

Last updated on: 2026-09-13

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: sysctl: move the "cad_pid" entry from pid_table[] to kern_reboot_table[] cad_pid is global, and kill_cad_pid() is only used in the root namespace. However, due to pid_table_root_permissions(), a non-root user can unshare pid/user namespaces and modify it from the child namespace. This makes no sense and is simply wrong. Move it to kern_reboot_table[] where it logically belongs; this ensures that only GLOBAL_ROOT_UID can read/modify this sysctl. Note that this patch doesn't preserve "#ifdef CONFIG_PROC_SYSCTL" around the "cad_pid"; CONFIG_PROC_SYSCTL selects CONFIG_SYSCTL, so it is always set when kern_reboot_table[] is compiled.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-13

Generated

2026-10-02

AI Q&A

2026-09-12

EPSS Evaluated

2026-09-29

NVD

CVE-2026-80929

EUVD

EUVD-2026-76252

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a misplaced sysctl entry called cad_pid. It was incorrectly placed in pid_table[] but should be in kern_reboot_table[]. Due to this, a non-root user could unshare pid/user namespaces and modify cad_pid from a child namespace, which is incorrect behavior since cad_pid is global and only kill_cad_pid() should use it in the root namespace.

The fix moves cad_pid to kern_reboot_table[] to ensure only users with GLOBAL_ROOT_UID can read or modify it.

Detection Guidance

This vulnerability is specific to the Linux kernel's sysctl handling of cad_pid. Detection requires checking kernel version and sysctl configurations. Use 'uname -r' to check kernel version and 'sysctl -a | grep cad_pid' to verify if cad_pid is exposed in pid_table.

Impact Analysis

This vulnerability could allow a non-root user to manipulate system reboot behavior by modifying cad_pid from an unshared namespace. This might lead to unexpected system reboots or denial of service if misused.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It involves a Linux kernel sysctl misconfiguration where a non-root user can modify a global PID entry in a child namespace, which is a privilege escalation issue rather than a data protection or privacy concern.

Mitigation Strategies

Apply the kernel patch that moves cad_pid to kern_reboot_table. Update to a patched kernel version. Restrict unprivileged user access to pid/user namespaces via kernel parameters like 'kernel.unprivileged_userns_clone=0'.

Hi! I’m here to help you understand CVE-2026-80929. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70