CVE-2026-80929: sysctl: move the "cad_pid" entry from pid_table[] to kern_reboot_table[]
In the Linux kernel, the following vulnerability has been resolved:
sysctl: move the "cadpid" entry from pidtable[] to kernreboottable[]
cadpid is global, and killcadpid() is only used in the root namespace.
However, due to pidtablerootpermissions(), a non-root user can unshare pid/user namespaces and modify it from the child namespace. This makes no sense and is simply wrong.
Move it to kernreboottable[] where it logically belongs; this ensures that only GLOBALROOTUID can read/modify this sysctl.
Note that this patch doesn't preserve "#ifdef CONFIGPROCSYSCTL" around the "cadpid"; CONFIGPROCSYSCTL selects CONFIGSYSCTL, so it is always set when kernreboottable[] is compiled.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Configuration
Move the global "cad_pid" sysctl entry from pid_table[] to kern_reboot_table[] so that only GLOBAL_ROOT_UID can read or modify it.
Linux kernel sysctl cad_pid table placement and access = kern_reboot_table[]; readable and modifiable only by GLOBAL_ROOT_UID
Event History
Frequently Asked Questions
Who can modify this setting on an affected system?
A non-root user who can create child PID and user namespaces can modify cad_pid from within that child namespace, even though cad_pid is global and used only in the root namespace.
What condition is needed to exploit the issue?
The attacker needs the ability to unshare PID and user namespaces. The issue is tied to namespace creation and access to the sysctl interface.
How does the fix change access to cad_pid?
The fix moves cad_pid into kern_reboot_table[] and restricts reading and modification of the sysctl to GLOBAL_ROOT_UID.