{"id":"CVE-2026-78408","aliases":[],"cve":{"records":[{"id":"CVE-2026-78408","source":"redhat","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-08-24T14:40:14.511Z","published":"2026-09-02T15:05:33.555Z","modified":"2026-11-05T02:43:52.916Z"}],"publishers":[{"name":"redhat","role":"CNA","organizationId":"53f830b8-0a3f-465b-8143-3b8a9948e749","modified":"2026-11-05T02:43:52.916Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-09-04T02:32:41.535Z"},{"name":"CVE","role":"ADP","organizationId":"af854a3a-2127-422b-91ae-364da2661108","modified":"2026-09-05T13:06:53.205Z"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:63162","tags":["vendor-advisory","x_refsource_REDHAT"],"source":"redhat"},{"url":"https://access.redhat.com/errata/RHSA-2026:93461","tags":["vendor-advisory","x_refsource_REDHAT"],"source":"redhat"},{"url":"https://access.redhat.com/errata/RHSA-2026:95365","tags":["vendor-advisory","x_refsource_REDHAT"],"source":"redhat"},{"url":"https://access.redhat.com/security/cve/CVE-2026-78408","tags":["vdb-entry","x_refsource_REDHAT"],"source":"redhat"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2522497","tags":["issue-tracking","x_refsource_REDHAT"],"source":"redhat"},{"url":"https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj","tags":[],"source":"redhat"},{"url":"https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj","tags":["exploit"],"source":"CISA-ADP"},{"url":"http://www.openwall.com/lists/oss-security/2026/09/05/2","tags":[],"source":"CVE"}],"weaknesses":[{"id":"CWE-775","description":"Missing Release of File Descriptor or Handle after Effective Lifetime","source":"redhat"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-09-04T02:32:17.411553Z","decisions":[{"name":"Exploitation","value":"poc"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"partial"}]}]},"title":"Util-linux: util-linux: nsenter --join-cgroup leaks root cgroup migration authority","titleSource":"redhat","descriptionSource":"redhat","description":"The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes.","score":7.9,"severity":"high","published":"2026-09-02T15:05:33.555Z","modified":"2026-11-05T02:43:52.916Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Red Hat","name":"Red Hat Enterprise Linux 10","platforms":[],"versions":[{"version":"0:2.40.2-18.el10_2.20","status":"unaffected","lessThan":"*","versionType":"rpm"}],"defaultStatus":"affected","cpes":["cpe:/o:redhat:enterprise_linux:10.2"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-78408"},{"vendor":"Red Hat","name":"Red Hat Cost Management On-Premise 1","platforms":[],"versions":[{"version":"1793825318","status":"unaffected","lessThan":"*","versionType":"rpm"}],"defaultStatus":"affected","cpes":["cpe:/a:redhat:cost_management_on_premise:1::el10"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-78408"},{"vendor":"Red Hat","name":"Red Hat Hardened Images","platforms":[],"versions":[{"version":"2.42.2-3.4.hum1","status":"unaffected","lessThan":"*","versionType":"rpm"}],"defaultStatus":"affected","cpes":["cpe:/a:redhat:hummingbird:1"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-78408"},{"vendor":"Red Hat","name":"Red Hat Enterprise Linux 7","platforms":[],"versions":[],"defaultStatus":"unaffected","cpes":["cpe:/o:redhat:rhel_els:7"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-78408"},{"vendor":"Red Hat","name":"Red Hat Enterprise Linux 8","platforms":[],"versions":[],"defaultStatus":"unaffected","cpes":["cpe:/a:redhat:enterprise_linux:8"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-78408"},{"vendor":"Red Hat","name":"Red Hat Enterprise Linux 9","platforms":[],"versions":[],"defaultStatus":"unaffected","cpes":["cpe:/a:redhat:enterprise_linux:9"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-78408"},{"vendor":"Red Hat","name":"Red Hat Enterprise Linux 9","platforms":[],"versions":[],"defaultStatus":"unaffected","cpes":["cpe:/a:redhat:enterprise_linux:9"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-78408"},{"vendor":"Red Hat","name":"Red Hat Enterprise Linux 9","platforms":[],"versions":[],"defaultStatus":"unaffected","cpes":["cpe:/a:redhat:enterprise_linux:9"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-78408"},{"vendor":"Red Hat","name":"Red Hat OpenShift Container Platform 4","platforms":[],"versions":[],"defaultStatus":"unaffected","cpes":["cpe:/a:redhat:openshift:4"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-78408"},{"vendor":"Red Hat","name":"Red Hat OpenShift Container Platform 4","platforms":[],"versions":[],"defaultStatus":"unaffected","cpes":["cpe:/a:redhat:openshift:4"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-78408"},{"vendor":"Red Hat","name":"Red Hat OpenShift Container Platform 5","platforms":[],"versions":[],"defaultStatus":"unaffected","cpes":["cpe:/a:redhat:openshift:5"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-78408"}],"remediation":[{"text":"Upgrade to util-linux v2.41.6, v2.42.3, or later. Until a fix is applied, do not run nsenter --join-cgroup (including nsenter --target PID --all --join-cgroup) against untrusted processes or namespaces. The fix closes the cgroup.procs descriptor immediately after joining, and opens it with O_CLOEXEC.","source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-78408"}],"references":["https://access.redhat.com/errata/RHSA-2026:63162","https://access.redhat.com/errata/RHSA-2026:93461","https://access.redhat.com/errata/RHSA-2026:95365","https://access.redhat.com/security/cve/CVE-2026-78408","https://bugzilla.redhat.com/show_bug.cgi?id=2522497","https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj","http://www.openwall.com/lists/oss-security/2026/09/05/2"],"sources":[{"name":"CVE","id":"CVE-2026-78408","modified":"2026-11-05T02:43:52.916Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-78408"}],"assessments":[{"source":"redhat","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H","score":7.9}],"sourceAffected":[],"observedAt":"2026-11-05T03:15:18.578Z","kev":{"status":"not-listed","checkedAt":"2026-11-05T07:00:31.683Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-10-30T15:40:41.502Z","attemptedAt":"2026-10-30T15:40:41.502Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-10-30T15:40:40.622Z","attemptedAt":"2026-10-30T15:40:40.622Z"},{"source":"EUVD","status":"refresh-failed","attemptedAt":"2026-10-30T15:40:38.220Z"},{"source":"EPSS","status":"available","checkedAt":"2026-10-30T15:40:43.924Z","attemptedAt":"2026-10-30T15:40:43.924Z"}],"evidence":[{"source":"NVD","id":"CVE-2026-78408","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78408","modified":"2026-10-30T14:17:09.807","score":7.9,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H","checkedAt":"2026-10-30T15:40:41.502Z"},{"source":"FIRST EPSS","id":"CVE-2026-78408","url":"https://www.first.org/epss/","probability":0.00193,"percentile":0.09061,"date":"2026-10-30","checkedAt":"2026-10-30T15:40:43.924Z"}],"aiSummary":{"text":"The nsenter --join-cgroup option in util-linux leaks root cgroup migration authority, allowing an unprivileged user to migrate and terminate unrelated root processes after a privileged operator uses --join-cgroup against an attacker-controlled target. The vulnerability requires the attacker to have access to the target cgroup. The exact affected versions are not specified.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-05T03:16:05.184Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-78408"}]}}