CVE-2026-78408

util-linux's nsenter --join-cgroup option opens the target cgroup's cgroup.procs file as root and fails to close that descriptor across later namespace and credential changes and execve(), a classic missing-release file-descriptor flaw (CWE-775). The vulnerability is triggered when a privileged operator runs nsenter --join-cgroup against a target controlled by an attacker; the program launched inside that target inherits the descriptor opened with root credentials, allowing it to migrate host processes between cgroups. As a result, an unprivileged user can subsequently move and terminate unrelated root-owned processes, producing high integrity and availability impact with no confidentiality loss (CVSS 3.1 score 7.9, local attack with user interaction required). Any Linux system shipping a vulnerable nsenter with the --join-cgroup option is affected, most notably builds maintained under Red Hat's stewardship as the assigned CNA; exact version ranges were not provided in the source data. No public proof-of-concept is known, no exploitation has been reported in the wild, the flaw is not in CISA KEV, and EPSS estimates only about a 0.1% probability of exploitation in the next 30 days.

What to do: Track and apply the patched util-linux update from your distribution vendor (Red Hat, as the assigned CNA, will publish errata) as soon as a fixed release is announced, since no fixed version number is provided in the current data. Until patched, avoid running nsenter --join-cgroup against cgroups or targets controlled by unprivileged or untrusted users. Also audit recently launched processes for inherited descriptors from such invocations and check for unexpected migration or termination of root-owned processes across cgroups.