CVE-2026-78408: util-linux
Vulnerability summary
CVE-2026-78408 is a high (CVSS 7.9) vulnerability in util-linux. EPSS estimates a 0.19% chance of exploitation in the next 30 days, higher than 7.7% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 6 · Related 5Timeline
- 02-09-2026PublishedVulnerability first disclosed.
- 05-09-2026Last modifiedVulnerability information updated.
Description
The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes.
CVSS metrics
5 scores · 5 sources · 1 version- OSV · AlpineEcosystem advisory · calculated7.9HighCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H
- OSV · UbuntuEcosystem advisory · calculated7.9HighCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H
- OSV · DebianEcosystem advisory · calculated7.9HighCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H
- NVDNIST7.9HighCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H
EPSS trend
Probability
0.19%
Chance of exploitation in the next 30 days
Percentile
8%
Versus all other CVEs
30-day change
+0.07 pp
From 0.11% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Alpine1 product
- util-linux< 2.41.6-r1 | < 2.42.3-r1
Debian1 product
- util-linuxAll versions (No fix recorded) | < 2.42.4-1
Ubuntu1 product
- util-linuxAll versions (No fix recorded)
3 vendors · 3 products
