CVE-2026-80929: Linux Kernel Privilege Escalation Vulnerability

CVE-2026-80929 Overview

CVE-2026-80929 is a Linux kernel vulnerability in the sysctl subsystem. The cad_pid entry, which controls the process signaled on Ctrl-Alt-Delete, was incorrectly placed in pid_table[]. Because of pid_table_root_permissions(), an unprivileged local user could unshare PID and user namespaces, then modify cad_pid from the child namespace. The value is global and consumed only in the root namespace by kill_cad_pid(), so the exposure allowed namespace-confined users to influence a root-scoped kernel state variable. The upstream fix relocates the entry to kern_reboot_table[], restricting read and write access to GLOBAL_ROOT_UID.

Critical Impact
A local, unprivileged user could modify a global reboot-related kernel setting by exploiting namespace permission handling in sysctl.

Affected Products

Linux kernel branches containing the pid_table[]cad_pid entry
Distributions shipping vulnerable stable kernel builds prior to the referenced fix commits
Systems where unprivileged user namespaces are enabled (kernel.unprivileged_userns_clone=1)

Discovery Timeline

2026-09-11 - CVE-2026-80929 published to NVD
2026-09-13 - Last updated in NVD database

Technical Details for CVE-2026-80929

Vulnerability Analysis

The cad_pid sysctl determines which process receives the signal generated by Ctrl-Alt-Delete via kill_cad_pid(). This value is a global kernel state used exclusively in the initial (root) PID namespace. The sysctl entry was registered inside pid_table[], which applies pid_table_root_permissions() when evaluating access. That helper grants write permission to the root user of the current user namespace, not only to GLOBAL_ROOT_UID.

Any local user able to call unshare(CLONE_NEWUSER | CLONE_NEWPID) becomes root inside the new namespaces. From that context, the user could open /proc/sys/kernel/cad_pid and write an arbitrary PID. The kernel then honored that value at the global scope, allowing an unprivileged actor to redirect Ctrl-Alt-Delete signal delivery to a chosen process.

Root Cause

The defect is a misplacement of a global, root-only sysctl into a table whose permission model is namespace-scoped. pid_table_root_permissions() is intended for entries whose semantics are per-namespace. cad_pid has no per-namespace meaning, so allowing namespace-local root to modify it violates the intended privilege boundary. This is a broken access control flaw rooted in sysctl table membership rather than in the sysctl handler itself.

Attack Vector

Exploitation requires local access and the ability to create user and PID namespaces, which is enabled by default on many distributions. The attacker unshares namespaces, gains namespace-root, and writes to the cad_pid sysctl. No network access, no user interaction, and no prior privileges beyond an unprivileged shell are required. See the upstream fix commits 7170ca0, a09bc4e, and e8527de for the code change.

Detection Methods for CVE-2026-80929

Indicators of Compromise

Unexpected writes to /proc/sys/kernel/cad_pid from non-root UIDs
Processes invoking unshare(2) with CLONE_NEWUSER followed by writes to /proc/sys/kernel/
cad_pid values referencing PIDs unrelated to init, systemd, or the configured reboot handler

Detection Strategies

Audit kernel and syscall telemetry for unshare calls paired with subsequent openat/write operations against /proc/sys/kernel/cad_pid
Deploy auditd rules watching /proc/sys/kernel/cad_pid for write events and correlate with the invoking UID and namespace context
Baseline the expected value of cad_pid on managed hosts and alert on drift

Monitoring Recommendations

Forward auditd and eBPF-based process telemetry to a centralized analytics platform for correlation across hosts
Monitor for privilege-manipulation patterns such as repeated namespace unshares by non-service accounts
Track kernel version inventory to identify hosts still running pre-patch builds referenced in the upstream commits

How to Mitigate CVE-2026-80929

Immediate Actions Required

Apply the stable kernel updates that include commits 7170ca0, a09bc4e, and e8527de
Inventory hosts allowing unprivileged user namespaces and prioritize patching
Restrict shell access on multi-tenant systems until updated kernels are deployed

Patch Information

The upstream fix moves the cad_pid entry from pid_table[] to kern_reboot_table[]. This ensures only GLOBAL_ROOT_UID can read or modify the sysctl, aligning access control with the global semantics of kill_cad_pid(). Consume the fix from your distribution's stable kernel package once available, or from the referenced git.kernel.org commits when building from source.

Workarounds

Disable unprivileged user namespaces where feasible using sysctl -w kernel.unprivileged_userns_clone=0 on distributions that expose this toggle
Set the user.max_user_namespaces limit to 0 for untrusted user sessions to block namespace creation
Apply mandatory access control policies (SELinux, AppArmor) that deny writes to /proc/sys/kernel/cad_pid from non-root contexts

bash

# Configuration example
# Restrict unprivileged user namespace creation
sysctl -w kernel.unprivileged_userns_clone=0

# Cap user namespaces per user session
echo 0 > /proc/sys/user/max_user_namespaces

# Audit writes to the affected sysctl
auditctl -w /proc/sys/kernel/cad_pid -p wa -k cad_pid_write