CVE-2026-80929
- Source
- https://cve.org/CVERecord?id=CVE-2026-80929
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-80929.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-80929
- Downstream
- Published
- 2026-09-11T19:42:04Z
- Modified
- 2026-09-14T03:45:48Z
- Severity
-
- 7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- sysctl: move the "cad_pid" entry from pid_table[] to kern_reboot_table[]
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
sysctl: move the "cad_pid" entry from pid_table[] to kern_reboot_table[]
cad_pid is global, and kill_cad_pid() is only used in the root namespace.
However, due to pid_table_root_permissions(), a non-root user can unshare pid/user namespaces and modify it from the child namespace. This makes no sense and is simply wrong.
Move it to kern_reboot_table[] where it logically belongs; this ensures that only GLOBAL_ROOT_UID can read/modify this sysctl.
Note that this patch doesn't preserve "#ifdef CONFIG_PROC_SYSCTL" around the "cad_pid"; CONFIG_PROC_SYSCTL selects CONFIG_SYSCTL, so it is always set when kern_reboot_table[] is compiled.
- Database specific
{ "cna_assigner": "Linux", "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/80xxx/CVE-2026-80929.json" }- References
-
- https://git.kernel.org/stable/c/7170ca01623b399c97f2ae9d3e228badc1f25ea3
- https://git.kernel.org/stable/c/a09bc4eaa67e1a72df3b6d0beb3afeef1e1fdfcd
- https://git.kernel.org/stable/c/e8527de7fea191fda704792a56081f9009aeec37
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/80xxx/CVE-2026-80929.json
- https://nvd.nist.gov/vuln/detail/CVE-2026-80929
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git