CVE-2026-78408: Missing Release of File Descriptor or Handle after Effective Lifetime in Red Hat Red Hat Hardened Images

The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves the file descriptor open across namespace and credential changes and execve(). Because the kernel uses the credentials from the original open to check cgroup migrations, a program running in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes. This vulnerability affects util-linux versions 2.40 through 2.42.2 and was fixed in versions 2.41.6 and 2.42.3. Red Hat Hardened Images include affected util-linux versions and have released updated RPMs to address this issue.

An attacker controlling a target namespace can leverage this vulnerability to gain root-level authority to migrate and terminate unrelated root processes on the host. This results in a high impact on integrity and availability, allowing unauthorized process control and potential denial of service. Confidentiality is not affected. The vulnerability requires local access with low privileges and user interaction (a privileged operator running nsenter --join-cgroup).

Red Hat has released fixed versions of util-linux (2.41.6, 2.42.3, and later) that close the cgroup.procs descriptor immediately after joining and open it with O_CLOEXEC. Users should upgrade to these versions as soon as possible. Until the fix is applied, do not run nsenter --join-cgroup (including nsenter --target PID --all --join-cgroup) against untrusted processes or namespaces.