Log in Start free

Vulnerability · Published Sep 2, 2026 · Assigned by redhat

CVE-2026-78408Util-linux: util-linux: nsenter --join-cgroup leaks root cgroup migration authority

High 7.9

In plain English

A high-severity security flaw in Red Hat Cost Management On-Premise 1 from Red Hat. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.9High
Exploit odds (30 days)0.2%top 85.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:10libblkid2.40.2-18.el10_2.20ALSA-2026:93461
AlmaLinux:10libblkid-devel2.40.2-18.el10_2.20ALSA-2026:93461
AlmaLinux:10libfdisk2.40.2-18.el10_2.20ALSA-2026:93461
AlmaLinux:10libfdisk-devel2.40.2-18.el10_2.20ALSA-2026:93461
AlmaLinux:10libmount2.40.2-18.el10_2.20ALSA-2026:93461
AlmaLinux:10libmount-devel2.40.2-18.el10_2.20ALSA-2026:93461
AlmaLinux:10libsmartcols2.40.2-18.el10_2.20ALSA-2026:93461
AlmaLinux:10libsmartcols-devel2.40.2-18.el10_2.20ALSA-2026:93461
AlmaLinux:10libuuid2.40.2-18.el10_2.20ALSA-2026:93461
AlmaLinux:10libuuid-devel2.40.2-18.el10_2.20ALSA-2026:93461
AlmaLinux:10python3-libmount2.40.2-18.el10_2.20ALSA-2026:93461
AlmaLinux:10util-linux2.40.2-18.el10_2.20ALSA-2026:93461
AlmaLinux:10util-linux-core2.40.2-18.el10_2.20ALSA-2026:93461
AlmaLinux:10uuidd2.40.2-18.el10_2.20ALSA-2026:93461
Alpine:v3.22util-linux2.41.6-r1ALPINE-CVE-2026-78408
Alpine:v3.23util-linux2.41.6-r1ALPINE-CVE-2026-78408
Alpine:v3.24util-linux2.42.3-r1ALPINE-CVE-2026-78408
Debian:13util-linuxno fix listedDEBIAN-CVE-2026-78408
Debian:14util-linux2.42.4-1DEBIAN-CVE-2026-78408
Rocky Linux:10util-linux0:2.40.2-18.el10_2.20RLSA-2026:93461
Ubuntu:22.04:LTSutil-linuxno fix listedUBUNTU-CVE-2026-78408
Ubuntu:24.04:LTSutil-linuxno fix listedUBUNTU-CVE-2026-78408
Ubuntu:26.04:LTSutil-linuxno fix listedUBUNTU-CVE-2026-78408
Ubuntu:26.10util-linuxno fix listedUBUNTU-CVE-2026-78408

Affected products (as reported)

VendorProductVersions
Red Hat Red Hat Enterprise Linux 10 see references
Red Hat Red Hat Cost Management On-Premise 1 see references
Red Hat Red Hat Hardened Images see references
Red Hat Red Hat Enterprise Linux 7 see references
Red Hat Red Hat Enterprise Linux 8 see references
Red Hat Red Hat Enterprise Linux 9 see references
Red Hat Red Hat Enterprise Linux 9 see references
Red Hat Red Hat Enterprise Linux 9 see references
Red Hat Red Hat OpenShift Container Platform 4 see references
Red Hat Red Hat OpenShift Container Platform 4 see references
Red Hat Red Hat OpenShift Container Platform 5 see references

Weakness: CWE-775 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H

References