CVE-2026-78408 Overview
CVE-2026-78408 affects the nsenter utility from util-linux. The --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across subsequent namespace and credential changes, including execve(). Because the kernel evaluates later cgroup migrations against the credentials captured at open time, code running inside an attacker-controlled target inherits root's authority to move processes between cgroups. After a privileged operator invokes --join-cgroup against such a target, an unprivileged user can migrate and terminate unrelated root processes on the host. The weakness is classified as missing release of file descriptor or handle after effective lifetime [CWE-775].
Critical Impact
An unprivileged local user in an attacker-controlled target can migrate and kill host root processes after a privileged operator uses nsenter --join-cgroup.
Affected Products
- util-linuxnsenter utility
- Linux distributions packaging affected util-linux versions (see Red Hat advisory)
- Container tooling and orchestration environments that invoke nsenter --join-cgroup
Discovery Timeline
- 2026-09-02 - CVE-2026-78408 published to NVD
- 2026-09-02 - Last updated in NVD database
Technical Details for CVE-2026-78408
Vulnerability Analysis
The flaw is a file descriptor leak across privilege and namespace boundaries in nsenter. When an operator runs nsenter --join-cgroup, the utility opens cgroup.procs inside the target cgroup while still holding root credentials. That descriptor persists across setns(), credential drops, and execve(), entering the address space of the target process. The Linux kernel does not re-evaluate authorization for cgroup migrations on each write. Instead, it uses the credentials recorded when the file was opened. Any process holding the leaked descriptor can therefore write process IDs into cgroup.procs with root's authority, even though the acting process is unprivileged.
Root Cause
The root cause is failure to mark the cgroup.procs descriptor close-on-exec or to close it before transitioning into the target environment [CWE-775]. The descriptor outlives its intended effective lifetime and crosses a trust boundary from the privileged operator into an attacker-controlled process.
Attack Vector
Exploitation requires local access and a specific sequence. An attacker prepares a target cgroup or container. A privileged operator runs nsenter --join-cgroup against that target. An unprivileged process spawned inside the target then writes arbitrary process IDs into the inherited cgroup.procs descriptor. Because the kernel honors the original opener's root credentials, the attacker can move host root processes into a constrained or frozen cgroup, effectively terminating or disrupting them. This yields high impact to integrity and availability of unrelated host workloads without directly compromising confidentiality. See the GitHub Security Advisory GHSA-55fx-f4gg-cfhj for additional technical detail.
Detection Methods for CVE-2026-78408
Indicators of Compromise
- Unexpected writes to cgroup.procs files originating from unprivileged processes running inside containers or targeted namespaces.
- Host root processes appearing in cgroups associated with untrusted workloads or containers.
- Abrupt termination or freezing of system daemons following administrative use of nsenter --join-cgroup.
Detection Strategies
- Audit invocations of nsenter with the --join-cgroup flag using auditd execve rules and correlate with subsequent cgroup membership changes.
- Monitor open file descriptors held by processes after execve() for references to /sys/fs/cgroup/**/cgroup.procs owned by different user namespaces.
- Track cgroup migrations via kernel tracepoints such as cgroup:cgroup_attach_task to flag cross-privilege transitions.
Monitoring Recommendations
- Log administrator use of nsenter against untrusted containers and require change-management approval.
- Alert on any process writing to cgroup.procs when the writing PID is unprivileged but the target PID is a host root process.
- Baseline expected cgroup membership for critical services and alert on deviations.
How to Mitigate CVE-2026-78408
Immediate Actions Required
- Avoid using nsenter --join-cgroup against untrusted or attacker-influenced targets until a patched util-linux is deployed.
- Inventory automation, container tooling, and operator runbooks that call nsenter --join-cgroup and gate their use.
- Apply vendor updates as soon as they are published for your distribution.
Patch Information
Refer to the Red Hat CVE-2026-78408 Advisory, the Red Hat Bug Report #2522497, and the upstream GitHub Security Advisory GHSA-55fx-f4gg-cfhj for fixed package versions. The fix ensures the cgroup.procs descriptor is closed before transitioning into the target namespace and credential context, or is marked close-on-exec.
Workarounds
- Prefer container-native execution mechanisms such as kubectl exec, crictl exec, or podman exec that do not rely on nsenter --join-cgroup.
- Restrict which operators can run nsenter on hosts, using sudo policies or role-based access controls.
- Where --join-cgroup is required, run nsenter from an isolated management host and never against targets containing untrusted code.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
