CVE-2026-80929

What it actually does

The vulnerability permits a non-root user to unshare pid and user namespaces and then modify the cad_pid sysctl entry via incorrect permission checks in pid_table_root_permissions(), allowing unauthorized read/modify access to a global kernel parameter that should be restricted to GLOBAL_ROOT_UID.

Why it matters to the business

Local attackers could alter critical reboot-related kernel behavior on affected Linux systems, increasing risk of system instability or unauthorized interference with shutdown handling in multi-tenant or containerized environments.

How an attack unfolds

An attacker with local access creates unshared pid and user namespaces, then uses the child namespace to bypass root-only restrictions and modify cad_pid, which controls kill_cad_pid behavior that is intended only for the root namespace.

How to fix it

Upgrade to a Linux kernel version containing the fix that relocates the cad_pid entry from pid_table[] to kern_reboot_table[] to enforce GLOBAL_ROOT_UID-only access.

How to confirm the fix worked

Inspect kernel source or compiled sysctl tables to confirm cad_pid resides in kern_reboot_table[] and that pid_table_root_permissions() no longer governs it; test that non-root namespace modifications are rejected.

Typical attack path

1. Obtain local shell access as a non-root user
2. Unshare pid and user namespaces
3. Modify the cad_pid sysctl entry from within the child namespace
4. Observe or leverage changes to kill_cad_pid behavior

How to detect it

Review audit logs for sysctl writes to cad_pid entries, namespace unshare events by non-root users, or unexpected changes to kernel reboot parameters; correlate with process creation of unshare or nsenter utilities.

What your security team should do

• Prioritize kernel updates on all Linux hosts within the next patch cycle
• Review and tighten user namespace creation policies where feasible
• Enable audit logging for sysctl modifications and namespace operations