CVE-2026-18107 is a vulnerability in CRIU's handling of restartable sequences (rseq) during checkpoint and restore operations. A malicious container process can register an rseq critical section that hijacks CRIU's parasite code injection during checkpoint, enabling spoofing of process credentials saved in the checkpoint image. Upon restore, the container process gains elevated capabilities and zeroed user and group IDs. The vulnerability's practical impact on Red Hat products is limited by several factors: checkpoint/restore requires root privileges (podman) or cluster-admin RBAC (OpenShift) and cannot be initiated from within the container; OpenShift prior to 4.17 requires explicit opt-in for checkpoint/restore, and in 4.17+ the kubelet checkpoint API RBAC is not configured by default; OpenShift enforces user namespaces by default, making spoofed capabilities namespace-scoped and ineffective for privilege escalation; SELinux type enforcement blocks privilege transitions independently of capabilities; seccomp filters persist and cannot be corrupted; and kernel mount namespace ownership checks on RHEL 9/10 prevent mount-based container escape even with spoofed capabilities.

If exploited, a malicious container process can gain elevated capabilities and zeroed UIDs/GIDs after checkpoint/restore, potentially escalating privileges within the container namespace. However, the requirement for root or cluster-admin privileges to trigger checkpoint/restore, combined with container security features such as user namespaces, SELinux enforcement, seccomp filters, and kernel mount namespace ownership checks, significantly limits the practical impact and prevents container escape or host privilege escalation.

No official patch or fix is explicitly stated in the provided advisory content. The vulnerability requires privileged access to trigger checkpoint/restore, which is typically restricted. Red Hat products enforce multiple security controls that mitigate exploitation impact, including user namespaces, SELinux, seccomp, and kernel namespace ownership checks. Users should ensure that checkpoint/restore operations are restricted to trusted administrators and that security policies (RBAC, SELinux, seccomp) are properly enforced. Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-18107 for current remediation guidance.