UBUNTU-CVE-2026-73860: Medium severity ubuntu/criu vulnerability
CRIU is a checkpoint and restore tool for Linux. Prior to 4.2.1, CRIU injects a syscall;int3 sequence at the start of the first executable virtual memory area and resumes the target process to execute parasite code. Malicious code in the target process can keep an rseq critical section armed over that injection point so the kernel's restartable-sequence abort redirects execution to an attacker-controlled callback when CRIU resumes the process. In container snapshot environments, the hijacked parasite runs with seccomp disabled and a relaxed AppArmor profile and supplies trusted data to the privileged CRIU process, which can enable higher-privilege code execution. This issue is fixed in version 4.2.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
CRIUto a version that resolves this vulnerability.Fixed in 4.2.1
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Systems using CRIU to checkpoint or restore processes are exposed, particularly container snapshot environments where CRIU resumes a target process and its parasite code may run with seccomp disabled and a relaxed AppArmor profile.
What does an attacker need to exploit it?
The attacker needs malicious code already running in the target process and must keep an rseq critical section armed across CRIU's syscall;int3 injection point. Exploitation also requires CRIU to resume that process during checkpoint or restore handling.
What is the impact if exploitation succeeds?
The rseq abort can redirect execution to an attacker-controlled callback when CRIU resumes the process. In the described container snapshot scenario, the hijacked parasite can provide trusted data to the privileged CRIU process, enabling higher-privilege code execution.
What should be done if patching is not immediately possible?
The provided information does not specify a workaround. Reducing or avoiding CRIU checkpoint and restore operations for processes that may execute attacker-controlled code limits exposure until CRIU can be updated.
Which CRIU versions are affected?
Versions prior to 4.2.1 are affected. The issue is fixed in CRIU 4.2.1.