CVE-2026-18107 Overview
CVE-2026-18107 is a privilege escalation flaw in Checkpoint/Restore In Userspace (CRIU) affecting the handling of restartable sequences (rseq) during checkpoint and restore operations. A malicious process running inside a container can register an rseq critical section that hijacks CRIU's parasite code injection during checkpoint. This allows the attacker to spoof process credentials stored in the checkpoint image. On restore, the container process gains elevated capabilities and zeroed UIDs/GIDs. The weakness maps to [CWE-269: Improper Privilege Management].
Critical Impact
A container process can forge credentials in a CRIU checkpoint image and re-emerge on restore with root-level UIDs/GIDs and elevated capabilities.
Affected Products
- CRIU (Checkpoint/Restore In Userspace)
- Red Hat OpenShift Container Platform (checkpoint/restore feature)
- Podman container runtime environments using CRIU checkpointing
Discovery Timeline
- 2026-07-28 - CVE-2026-18107 published to NVD
- 2026-07-30 - Last updated in NVD database
Technical Details for CVE-2026-18107
Vulnerability Analysis
CRIU freezes running processes and serializes their state, including credentials, into a checkpoint image for later restoration. To read process state, CRIU injects a small piece of code called the parasite into the target process using ptrace. The parasite executes in the target's address space and reports back structures such as credentials, memory maps, and file descriptors.
The flaw arises because CRIU does not adequately isolate parasite execution from rseq critical sections registered by the target process. Restartable sequences are a Linux kernel feature that lets user space register a code region the kernel will restart if preempted or signaled. A hostile process inside a container can register an rseq region that overlaps or intercepts the control flow used by CRIU's parasite. When CRIU triggers execution, the attacker-controlled handler runs in place of expected parasite logic and rewrites the credential structures CRIU serializes to disk.
On restore, CRIU reconstructs the process using the tampered image. The kernel accepts the forged credentials, granting the restored process UID 0, GID 0, and elevated Linux capabilities.
Root Cause
The root cause is missing validation of rseq state on the traced process before CRIU injects and executes parasite code. CRIU trusts that the injected parasite runs uninterrupted, but the rseq mechanism can redirect execution to attacker-controlled memory during the checkpoint window.
Attack Vector
Exploitation requires a local, unprivileged process inside a container that is subsequently checkpointed. The container itself cannot initiate the checkpoint; a host administrator with root (Podman) or a cluster user with checkpoint RBAC on OpenShift must trigger it. Once triggered, the malicious process manipulates its rseq registration to hijack the parasite and produce a checkpoint image containing spoofed credentials.
Real-world impact against Red Hat products is constrained. On OpenShift 4.17+ the kubelet checkpoint API RBAC is not configured by default, user namespaces are enforced for regular workloads, SELinux container_t blocks privilege transitions independently of capabilities, seccomp filters persist across restore, and RHEL 9/10 kernel mount namespace ownership checks prevent mount-based escape even with forged capabilities.
See the CRIU upstream fix for the corrective patch.
Detection Methods for CVE-2026-18107
Indicators of Compromise
- Restored container processes running with UID 0 or GID 0 that were checkpointed as unprivileged users
- Unexpected Linux capability sets (for example CAP_SYS_ADMIN, CAP_SYS_PTRACE) on processes after a CRIU restore
- Container processes registering rseq regions immediately before a scheduled checkpoint operation
- Checkpoint images whose serialized creds entries do not match the runtime credentials observed prior to checkpoint
Detection Strategies
- Compare pre-checkpoint and post-restore credentials for each container process; flag any elevation of UID, GID, or capability mask.
- Audit invocations of the Podman checkpoint/restore subcommands and the OpenShift kubelet checkpoint API for unexpected callers.
- Inspect CRIU checkpoint images with crit to validate that the core-*.img credential fields match runtime expectations.
Monitoring Recommendations
- Enable auditd rules on ptrace, rseq, and CRIU binary execution paths on hosts that permit checkpoint/restore.
- Alert on any RBAC grant that adds checkpoint permissions to non-administrative OpenShift service accounts.
- Forward container runtime logs and kubelet audit logs to a centralized data lake for correlation across checkpoint events.
How to Mitigate CVE-2026-18107
Immediate Actions Required
- Update CRIU to a version that includes the fix from checkpoint-restore/criu PR #3097.
- Restrict checkpoint/restore capabilities to trusted host administrators only; do not expose the kubelet checkpoint API without explicit RBAC review.
- Verify that OpenShift clusters keep user namespaces enforced by default and that hostUsers remains gated behind admin-only Security Context Constraints (SCCs).
- Confirm SELinux is in enforcing mode with the container_t type applied to workloads that may be checkpointed.
Patch Information
Red Hat tracks this issue in the Red Hat CVE Advisory and Bugzilla #2508140. Apply vendor-provided CRIU package updates as they become available through the standard errata channels for RHEL and OpenShift.
Workarounds
- Disable the checkpoint/restore feature on OpenShift clusters that do not require it, particularly on releases prior to 4.17 where opt-in was required.
- Remove checkpoint verbs from any non-administrative Kubernetes Role or ClusterRole bindings.
- Enforce seccomp profiles on all container workloads to preserve syscall restrictions across restore operations.
- Keep RHEL 9 or RHEL 10 kernels current so that mount namespace ownership checks remain in effect.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
