CVE-2026-78408: Util-linux: util-linux: nsenter --join-cgroup leaks root cgroup migration authority
nsenter --join-cgroup (sys-utils/nsenter.c) opens the target cgroup v2 cgroup.procs while still running as root, writes nsenter's own PID to join that cgroup, and then leaves the descriptor open across later namespace/credential transitions and execve(). The FD is neither closed nor marked OCLOEXEC. Linux performs later cgroup migration checks using the credentials captured in file->fcred at open time, so a program executed inside an attacker-controlled target inherits root's cgroup-migration authority even after dropping to an unprivileged UID with no capabilities. A privileged operator must invoke the documented --join-cgroup operation against the attacker-controlled target (nsenter is not SUID on typical distros). After the FD is inherited, an unprivileged process can migrate an unrelated host root PID into an attacker-owned systemd user-service cgroup and terminate it via cgroup.kill. This is not an autonomous LPE. Introduced by b40650b71a74 (2023-06-28); first released in util-linux v2.40. Affects v2.40 through v2.42.2 and current master (confirmed on Debian 13 util-linux 2.41-5). No upstream fix as of 2026-08-24. Reported upstream by 4drez. GHSA-55fx-f4gg-cfhj.
Other sources
The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
util-linux (nsenter)to a version that resolves this vulnerability.Fixed in 2.40 - Upgrade
Upgrade
util-linux (nsenter)to a version that resolves this vulnerability.Fixed in 2.41 - Upgrade
Upgrade
util-linux (nsenter)to a version that resolves this vulnerability.Fixed in 2.42.2 - Upgrade
Upgrade
util-linux (nsenter)to a version that resolves this vulnerability.Patch GHSA-55fx-f4gg-cfhj - Compensating control
Do not use nsenter --join-cgroup on attacker-controlled targets; avoid the documented --join-cgroup operation when the target namespace/cgroup is not trusted, since the option leaks root cgroup-migration authority.
Event History
Frequently Asked Questions
Which systems are realistically exposed?
Systems using util-linux v2.40 through v2.42.2, or current master, are affected. Exploitation also requires a privileged operator to run nsenter with --join-cgroup against an attacker-controlled target; nsenter is not SUID on typical distributions.
What must an attacker be able to do to exploit this?
The attacker needs to control the target cgroup and induce a privileged operator to invoke the documented --join-cgroup operation against it. The subsequently executed unprivileged process inherits a file descriptor opened with root credentials.
What can the inherited authority be used for?
An unprivileged inherited process can migrate an unrelated host root PID into an attacker-owned systemd user-service cgroup. It can then terminate that process through cgroup.kill.
What can be done until an upstream fix is available?
Avoid using nsenter --join-cgroup with attacker-controlled targets in privileged workflows. No upstream fix was available as of 2026-08-24.
How can I identify potentially affected installations?
Check the installed util-linux version: the issue was introduced before the v2.40 release and affects v2.40 through v2.42.2, as well as current master. It was confirmed on Debian 13 with util-linux 2.41-5.