REDHAT-BUG-2522497: High severity util-linux nsenter vulnerability
nsenter --join-cgroup (sys-utils/nsenter.c) opens the target cgroup v2 cgroup.procs while still running as root, writes nsenter's own PID to join that cgroup, and then leaves the descriptor open across later namespace/credential transitions and execve(). The FD is neither closed nor marked OCLOEXEC. Linux performs later cgroup migration checks using the credentials captured in file->fcred at open time, so a program executed inside an attacker-controlled target inherits root's cgroup-migration authority even after dropping to an unprivileged UID with no capabilities. A privileged operator must invoke the documented --join-cgroup operation against the attacker-controlled target (nsenter is not SUID on typical distros). After the FD is inherited, an unprivileged process can migrate an unrelated host root PID into an attacker-owned systemd user-service cgroup and terminate it via cgroup.kill. This is not an autonomous LPE. Introduced by b40650b71a74 (2023-06-28); first released in util-linux v2.40. Affects v2.40 through v2.42.2 and current master (confirmed on Debian 13 util-linux 2.41-5). No upstream fix as of 2026-08-24. Reported upstream by 4drez. GHSA-55fx-f4gg-cfhj.
Affected Software
Event History
Frequently Asked Questions
Can an unprivileged local user trigger this without assistance from a privileged operator?
No. Exploitation requires a privileged operator to invoke nsenter with the documented --join-cgroup option against an attacker-controlled target cgroup.
Is this an autonomous local privilege escalation through a normal nsenter installation?
No. nsenter is not SUID on typical distributions, and the issue requires the privileged --join-cgroup invocation described above.
What can an attacker do after inheriting the privileged cgroup file descriptor?
An unprivileged process can migrate an unrelated host root PID into an attacker-owned systemd user-service cgroup. It can then terminate that process using cgroup.kill.
What is the available temporary mitigation when no upstream fix is available?
Do not invoke nsenter --join-cgroup against cgroup targets controlled by untrusted users. This prevents the attacker-controlled process from inheriting the descriptor opened with root cgroup-migration authority.