ALPINE-CVE-2026-78408
The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes.
ALPINE-CVE-2026-78408
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:ALPINE-CVE-2026-78408
util-linux
Source reference: /affected/0/package/name
- Affected versions
- Not stated in this record
- Fixed versions
- 2.41.6-r1
Source reference:
/affected/0/ranges - Prerequisites
- Not stated in this record
util-linux
Source reference: /affected/1/package/name
- Affected versions
- Not stated in this record
- Fixed versions
- 2.41.6-r1
Source reference:
/affected/1/ranges - Prerequisites
- Not stated in this record
util-linux
Source reference: /affected/2/package/name
- Affected versions
- Not stated in this record
- Fixed versions
- 2.42.3-r1
Source reference:
/affected/2/ranges - Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.41.6-r1"
}
]
}
],
"package": {
"name": "util-linux",
"purl": "pkg:apk/alpine/util-linux?arch=source",
"ecosystem": "Alpine:v3.22"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2026-78408.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.41.6-r1"
}
]
}
],
"package": {
"name": "util-linux",
"purl": "pkg:apk/alpine/util-linux?arch=source",
"ecosystem": "Alpine:v3.23"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2026-78408.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.42.3-r1"
}
]
}
],
"package": {
"name": "util-linux",
"purl": "pkg:apk/alpine/util-linux?arch=source",
"ecosystem": "Alpine:v3.24"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2026-78408.json"
},
"ecosystem_specific": {}
}
]Publisher severity
No explicit severity was provided.
- Event
- #55174 · Revision 1
- Added to Heist Feed
- Publisher date