CVE-2026-78408 in Red Hat
Summary
by MITRE • 09/02/2026
The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/02/2026
The vulnerability identified involves a critical flaw in the implementation of the nsenter utility, specifically concerning its handling of control group file descriptors during namespace transitions. The core technical issue arises when the --join-cgroup option is invoked to attach to an existing cgroup hierarchy. In this process, the kernel opens the target's cgroup.procs file with root privileges and retains that open file descriptor throughout subsequent operations. Crucially, this file descriptor remains valid even after the calling process undergoes significant changes in its execution context, including namespace shifts and credential drops where effective user IDs are reduced from root to an unprivileged state. This persistence of privileged resources across security boundary crossings creates a dangerous discrepancy between the permissions held by the open file handle and the actual privileges of the executing thread.
The operational impact of this flaw is severe because it allows for privilege escalation through cgroup manipulation. Normally, migrating processes between control groups requires elevated privileges to prevent unauthorized interference with system resource allocation and process isolation. However, due to the kernel's design choice to validate subsequent cgroup migrations using the credentials present at the time the file descriptor was originally opened rather than the current credentials of the caller, an attacker can exploit this lag in permission checks. Once a privileged operator uses nsenter --join-cgroup against a target controlled by an unprivileged user, that user gains access to the open root-level cgroup.procs handle. This effectively grants them the ability to write process IDs into the file, thereby moving host processes from their current control groups into ones managed or influenced by the attacker.
This capability enables an unprivileged user to disrupt system stability and compromise security policies by terminating unrelated root processes. By migrating critical system daemons or services into a cgroup with restrictive kill permissions or one that is monitored for termination signals, the attacker can force these high-privilege processes to exit unexpectedly. This leads to denial of service conditions across the host environment, potentially affecting other users and applications sharing the same infrastructure. The attack vector relies on social engineering or prior access to trigger a privileged operator to run nsenter against a maliciously crafted target, making it particularly dangerous in multi-user environments where administrative tools are frequently used for debugging or container management tasks.
Mitigation strategies must address both the immediate code defect and broader operational practices regarding namespace utilities. From a technical standpoint, the kernel implementation should be patched to ensure that file descriptors opened with elevated privileges do not retain those permissions after credential changes unless explicitly intended through secure mechanisms such as capability bounding sets or explicit permission checks at each operation point rather than just at open time. Administrators should restrict access to nsenter and similar namespace manipulation tools using strict filesystem permissions, ensuring only trusted users can invoke them. Additionally, implementing mandatory access control policies like SELinux or AppArmor can limit the ability of unprivileged processes to interact with cgroup files regardless of file descriptor inheritance. Regular auditing of process migrations and monitoring for unexpected changes in cgroup assignments can also help detect exploitation attempts early.
This vulnerability aligns with CWE-250, which describes execution with unnecessary privileges, as the program retains root-level access to a resource long after it has dropped its high-privilege status. It is further categorized under CWE-787, out-of-bounds write, in the context of writing process IDs into cgroup files without proper validation against current credentials. In terms of attack taxonomy, this falls under MITRE ATT&CK technique T1612, which involves escape from a container or sandbox by leveraging misconfigurations in system namespaces and control groups to affect host-level resources. Understanding these classifications helps security teams prioritize patching efforts and configure monitoring rules that detect anomalous cgroup migrations originating from non-root processes.