The Linux kernel had a vulnerability where the 'cad_pid' sysctl entry was located in pid_table[], which permitted non-root users to unshare pid/user namespaces and modify 'cad_pid' from the child namespace. Since 'cad_pid' is global and kill_cad_pid() is only used in the root namespace, this behavior was incorrect. The fix involved moving 'cad_pid' to kern_reboot_table[], ensuring that only GLOBAL_ROOT_UID can read or modify it. This change corrects the logical placement and access control of the sysctl entry. The patch also clarifies that CONFIG_PROC_SYSCTL is always set when kern_reboot_table[] is compiled, so no conditional compilation around 'cad_pid' was preserved.

The vulnerability allowed non-root users to modify a global sysctl parameter 'cad_pid' by exploiting namespace unsharing, which could lead to unauthorized changes in kernel behavior related to this parameter. The impact is limited to the ability to modify this specific sysctl entry without proper privileges.

A fix is available that moves the 'cad_pid' sysctl entry to the correct kernel table (kern_reboot_table[]), restricting access to the global root user only. Users should apply the official kernel update that includes this patch to remediate the vulnerability.