CVE-2026-78408 Privilege Escalation in util-linux nsenter

CVE-2026-78408 is a privilege escalation vulnerability in the nsenter utility, part of the util-linux package. The vulnerability exists within the --join-cgroup implementation, where the utility opens the target cgroup.procs file with root privileges but fails to close the file descriptor before undergoing namespace and credential changes or executing new processes via execve().

When a privileged operator uses nsenter --join-cgroup to enter an attacker-controlled namespace, the vulnerable file descriptor remains open. Because the Linux kernel performs subsequent cgroup migration checks using the credentials associated with the original file descriptor open, an unprivileged user within the target namespace can leverage the inherited root context to migrate or terminate arbitrary host processes. This flaw effectively permits a user to break out of cgroup-based isolation, posing a significant risk to container and system security in environments where privileged operators regularly perform maintenance or debugging using nsenter.

Impact

Successful exploitation of this vulnerability allows an unprivileged user to gain unauthorized control over cgroup membership for host-level processes. This can be used to move processes out of their intended resource containers or to terminate critical system services running as root, potentially leading to denial of service or further system compromise. The scope of impact is local, requiring an attacker to have already achieved execution within a target namespace before a privileged operator initiates an nsenter session.

Recommendation

• Update the util-linux package to the vendor-provided patched version immediately.
• Restrict the use of nsenter --join-cgroup for operators until the system is patched.
• Implement host-level monitoring for unauthorized migration of root-owned processes between cgroups.
• Audit the use of nsenter in shared or containerized environments to minimize the window of opportunity for an attacker to influence target environments.