CVE-2026-80929

A permission-check gap in the Linux kernel's sysctl handling left the kernel.cad_pid entry in pid_table[], whose pid_table_root_permissions() check is satisfied from a child PID/user namespace created via unshare. A local user with a low-privilege account can therefore unshare user and PID namespaces and write to the global cad_pid value, redirecting the kernel's Ctrl-Alt-Del target to an arbitrary process ID. Because cad_pid is global and kill_cad_pid() operates only in the root namespace, this lets the attacker direct kernel-generated signals at processes outside their own namespace, impacting integrity and availability (CVSS 3.1: 7.8, local vector, low privileges required). Any host running an unfixed kernel is potentially affected, with the highest risk on multi-user machines, container hosts, or systems where unprivileged user namespaces are enabled and untrusted local code runs. No public proof of concept is known and the issue is not listed in CISA's KEV catalog.

What to do: Update to a kernel release that includes the fix moving cad_pid into kern_reboot_table[] (apply your distro's latest stable kernel updates). As an interim mitigation on hosts with untrusted local users or containers, restrict unprivileged user namespaces (e.g., set user.max_user_namespaces=0 or your distro's equivalent unprivileged-userns toggle). After patching, verify that writes to /proc/sys/kernel/cad_pid from a non-initial user namespace are rejected and that only global root can modify it.