CVE-2026-78408: 
CBL Mariner vulnerability analysis and mitigation

CVE-2026-78408 is a file descriptor leak vulnerability in the nsenter utility (part of util-linux) that allows a low-privileged local user to inherit root's cgroup migration authority and terminate unrelated root processes. The flaw was introduced in util-linux v2.40 (commit b40650b71a74, 2023-06-28) and affects versions v2.40 through v2.42.2. It was reported by independent security researcher Andreas Gabriel Berbescu (alias 4drez) and publicly disclosed on September 2, 2026. Fixed versions are v2.41.6 and v2.42.3. The CVSS v3.1 base score is 7.9 (High) (Red Hat CVE, GitHub Advisory).

The root cause is CWE-775 (Missing Release of File Descriptor or Handle after Effective Lifetime). The nsenter --join-cgroup option opens the target cgroup v2 cgroup.procs file while still running as root, writes its own PID to join the cgroup, and then fails to close the file descriptor or mark it O_CLOEXEC before performing namespace and credential transitions and calling execve(). The Linux kernel intentionally checks cgroup migration permissions using the credentials captured in file->f_cred at open time (a behavior introduced as a fix for CVE-2021-4197), so the executed program inherits root's migration authority regardless of its actual UID or capabilities. Exploitation requires: (1) a local attacker-controlled user account (UID 1000, no capabilities), (2) cgroup v2 enabled, (3) unprivileged user namespaces available, and (4) a privileged operator invoking nsenter --target PID --all --join-cgroup against the attacker-controlled target — this is not an autonomous privilege escalation (GitHub Advisory, Red Hat Bugzilla).

A successful exploit allows an unprivileged local user (UID 1000, no capabilities) to migrate arbitrary host root processes into an attacker-owned systemd user-service cgroup and terminate them via cgroup.kill, resulting in high integrity and availability impact with no confidentiality impact. Beyond process termination, migrating a root process into an attacker-controlled cgroup places it under the attacker's resource, freezer, and other policy controls. The scope is changed because the attack crosses from the attacker's user namespace delegation into control over unrelated host processes, potentially causing denial of service or disruption of critical system services (GitHub Advisory, Red Hat CVE).

A proof-of-concept exploit with detailed reproduction steps (setup.sh and repro.sh scripts) is publicly available in the upstream GitHub Security Advisory. The PoC was confirmed to work deterministically on Debian 13 (trixie) stock with util-linux 2.41-5 across 20/20 test runs. There is no evidence of in-the-wild exploitation at this time. The EPSS score is 0.00112 (low probability of exploitation in the near term), and the vulnerability is not listed in the CISA KEV catalog. Exploitation is not automatable as it requires a privileged operator to interact with the attacker-controlled target (GitHub Advisory, Feedly).

1. Prepare attacker-controlled target (UID 1000): As a local user (UID 1000) with an active systemd user manager, run setup.sh to create a transient systemd user service (ul-h02-auto.service) with a separate user/mount/PID namespace. Bind-mount an attacker-controlled wrapper script over /bin/bash within that mount namespace.
2. Wait for privileged operator action: The attacker waits for a root/CAP_SYS_ADMIN operator to run nsenter --join-cgroup against the attacker-controlled target process, e.g.: SHELL=/bin/bash /usr/bin/nsenter --target <ATTACKER_PID> --all --join-cgroup. This causes nsenter to open cgroup.procs as root and leave the FD open across credential transitions into the attacker's namespace.
3. Inherit root-opened file descriptor: The attacker's wrapper (executed as the shell inside the namespace) receives the leaked root-opened cgroup.procs file descriptor via the inherited FD table or relays it to a host-side UID-1000 process using SCM_RIGHTS over a Unix socket.
4. Migrate a root process: The host-side UID-1000 receiver writes a target root PID to the inherited cgroup.procs FD. The kernel performs the permission check using the original root credentials (file->f_cred), allowing the migration to succeed (EACCES is returned for a direct open, but the relayed FD succeeds).
5. Terminate the root process: The attacker writes to cgroup.kill in their owned service cgroup (which they legitimately control), terminating the migrated root process with exit status 137 (GitHub Advisory, Red Hat Bugzilla).

• Process: Unexpected child processes spawned by nsenter that relay file descriptors via Unix sockets; nsenter processes with --join-cgroup flags targeting user-owned PIDs.
• File System: Presence of files matching /tmp/ul-h02*, /tmp/nsenter_cgroup_fd_relay.py, or /tmp/ul-h02-auto.sock; attacker-controlled binaries bind-mounted over system paths (e.g., /bin/bash) visible in mount namespace inspection.
• Logs: Systemd journal entries showing unexpected transient user services (e.g., ul-h02-auto.service) created under user@1000.service/app.slice; audit logs recording cgroup migration events (cgroup_attach_task) for root-owned PIDs moving into UID-1000 cgroups; process exit events with status 137 (SIGKILL) for root-owned processes.
• Network: Unix socket activity at /tmp/ul-h02-auto.sock used for SCM_RIGHTS file descriptor relay between namespaces.
• cgroup: Unexpected root-owned PIDs appearing in /sys/fs/cgroup/user.slice/user-1000.slice/... cgroup hierarchies (GitHub Advisory).

Upgrade to util-linux v2.41.6 or v2.42.3, which fix the issue by closing cgroup_procs_fd immediately after join_into_cgroup() and opening cgroup.procs with O_CLOEXEC as defense in depth. Red Hat has released a fixed package (util-linux-main version 2.42.2-3.4.hum1 or later). Until a fix is applied, do not run nsenter --join-cgroup (including nsenter --target PID --all --join-cgroup) against untrusted processes or namespaces. Additionally, restrict unprivileged user access to directories where operators may use this functionality and review audit logs for suspicious cgroup migration activity (Red Hat CVE, oss-security).

The vulnerability was acknowledged by Red Hat, which credited independent researcher Andreas Gabriel Berbescu for the report and published a detailed advisory. The upstream util-linux maintainer (karelzak) published the GitHub Security Advisory (GHSA-55fx-f4gg-cfhj) on September 2, 2026. The oss-security mailing list carried discussion of the fix in util-linux 2.42.3, with Debian's Salvatore Bonaccorso noting a required follow-up fix for stable branches. BleepingComputer covered the vulnerability as part of Microsoft's September 2026 Patch Tuesday coverage, and Linux security outlets including LinuxSecurity.com reported on the Slackware advisory (oss-security, GitHub Advisory).