CVE-2026-80929 in Linux
Summary
by MITRE • 09/11/2026
In the Linux kernel, the following vulnerability has been resolved:
sysctl: move the "cad_pid" entry from pid_table[] to kern_reboot_table[]
cad_pid is global, and kill_cad_pid() is only used in the root namespace.
However, due to pid_table_root_permissions(), a non-root user can unshare pid/user namespaces and modify it from the child namespace. This makes no sense and is simply wrong.
Move it to kern_reboot_table[] where it logically belongs; this ensures
that only GLOBAL_ROOT_UID can read/modify this sysctl.
Note that this patch doesn't preserve "#ifdef CONFIG_PROC_SYSCTL" around the "cad_pid"; CONFIG_PROC_SYSCTL selects CONFIG_SYSCTL, so it is always set when kern_reboot_table[] is compiled.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/11/2026
The Linux kernel contains a privilege escalation vulnerability within the sysctl subsystem related to the cad_pid entry. This parameter controls the process ID of the Ctrl-Alt-Del handler, which is responsible for initiating system reboots or shutdowns when specific key combinations are pressed. The core issue stems from an incorrect placement of this configuration item in the kernel's hierarchical table structure. Specifically, cad_pid was located within pid_table[], a data structure that governs process ID namespace settings and inherits permissions associated with PID namespaces rather than global root privileges. This architectural misplacement creates a security gap where the access control mechanisms do not align with the sensitivity of the parameter being managed.
The technical flaw arises from how kernel permission checks are applied to sysctl entries based on their parent table context. The pid_table_root_permissions function dictates that certain operations within PID namespace tables may be accessible to users who have created unshared namespaces, even if they lack global root privileges. Because cad_pid was situated in this table, a non-root user could exploit the ability to create new PID and user namespaces via sys_unshare or clone system calls. Once inside such an isolated child namespace, the attacker gains the capability to modify the cad_pid value without holding GLOBAL_ROOT_UID credentials. This behavior is logically inconsistent because the Ctrl-Alt-Del handler operates at the global kernel level and affects all processes on the host, not just those within a specific user or PID namespace.
The operational impact of this vulnerability allows for potential denial-of-service attacks and unauthorized system reboots by unprivileged users. By altering cad_pid to point to a malicious process ID or an invalid value, an attacker could disrupt normal shutdown procedures, cause kernel panics if the referenced process does not exist, or interfere with legitimate administrative tasks that rely on standard reboot mechanisms. Furthermore, this misconfiguration violates the principle of least privilege and proper separation of duties within system administration tools. It allows local users to perform actions that should strictly require global root access, thereby undermining the integrity of the operating system's security model and potentially facilitating further exploitation if combined with other vulnerabilities in process management or signal handling subsystems.
To mitigate this risk, the vulnerability is resolved by relocating the cad_pid entry from pid_table[] to kern_reboot_table[]. This new table structure enforces stricter access controls that require GLOBAL_ROOT_UID for both reading and modifying the parameter. By aligning the sysctl location with its actual scope of influence, the kernel ensures that only administrators with full system privileges can adjust settings related to global reboot handlers. This change effectively closes the privilege escalation vector by ensuring that namespace isolation does not provide a pathway to modify globally significant configuration parameters. The fix also maintains compatibility with existing build configurations, as CONFIG_PROC_SYSCTL inherently selects CONFIG_SYSCTL, guaranteeing that the necessary infrastructure for kern_reboot_table[] is always present when needed.
From a classification perspective, this vulnerability aligns with CWE-269, which covers Improper Privilege Management, specifically regarding the failure to enforce proper access controls on sensitive system resources. It also relates to CWE-732, as it involves incorrect permission assignment that allows lower-privileged entities to perform high-level administrative functions. In terms of offensive security frameworks such as MITRE ATT&CK, this flaw facilitates Local Privilege Escalation techniques where an attacker leverages misconfigured kernel parameters to gain higher levels of access than intended by the system administrator. The remediation strategy exemplifies best practices in secure coding and configuration management by ensuring that global state modifications are restricted to trusted entities with appropriate authority.