Red Hat Enterprise Linux/OpenShift Container Platform up to 4.17 CRIU rseq checkpoint/restore privileges management

Summaryinfo

A vulnerability was found in Red Hat Enterprise Linux and OpenShift Container Platform 7/8/9/10/4.17 and classified as very critical. This affects an unknown part of the component CRIU rseq checkpoint/restore. Executing a manipulation can lead to privileges management. This vulnerability appears as CVE-2026-18107. The attack requires local access. There is no available exploit.

Detailsinfo

A vulnerability classified as very critical was found in Red Hat Enterprise Linux and OpenShift Container Platform 7/8/9/10/4.17. This vulnerability affects an unknown code of the component CRIU rseq checkpoint/restore. The manipulation with an unknown input leads to a privileges management vulnerability. The CWE definition for the vulnerability is CWE-269. The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

A flaw was found in CRIU's handling of restartable sequences (rseq) during checkpoint/restore. A malicious process inside a container can register an rseq critical section that hijacks CRIU's parasite code injection during checkpoint, allowing it to spoof the process credentials saved in the checkpoint image. On restore, the container process gains elevated capabilities and zeroed UIDs/GIDs. The practical impact on Red Hat products is limited by several factors: checkpoint/restore requires root privileges (podman) or cluster-admin RBAC (OpenShift) to trigger and cannot be initiated from within the container itself; on OpenShift prior to 4.17 the feature required explicit opt-in, and on 4.17+ the kubelet checkpoint API RBAC is not configured by default; OpenShift enforces user namespaces by default for regular workloads (hostUsers is gated behind admin-only SCCs), which makes the spoofed capabilities namespace-scoped and ineffective for privilege escalation; SELinux type enforcement (container_t) blocks privilege transitions independently of capabilities; seccomp filters persist through checkpoint/restore and cannot be corrupted via the parasite; and kernel mount namespace ownership checks on RHEL 9/10 kernels prevent mount-based container escape even with spoofed capabilities.

The advisory is shared for download at access.redhat.com. This vulnerability was named CVE-2026-18107 since 07/28/2026. The exploitation appears to be easy. The attack needs to be approached locally. Additional levels of successful authentication are necessary for exploitation. There are neither technical details nor an exploit publicly available. The current price for an exploit might be approx. USD $5k-$25k (estimation calculated on 07/28/2026). The MITRE ATT&CK project declares the attack technique as T1068.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Operating System

Vendor

• Red Hat

Name

• Enterprise Linux
• OpenShift Container Platform

Version

• 4.17
• 7
• 8
• 9
• 10

License

• commercial

Website

• Vendor: https://www.redhat.com/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion