Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-09-11T00:00:00 kernel: sysctl: move the "cad_pid" entry from pid_table[] to kern_reboot_table[] 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CWE-279

In the Linux kernel, the following vulnerability has been resolved: sysctl: move the "cad_pid" entry from pid_table[] to kern_reboot_table[] cad_pid is global, and kill_cad_pid() is only used in the root namespace. However, due to pid_table_root_permissions(), a non-root user can unshare pid/user namespaces and modify it from the child namespace. This makes no sense and is simply wrong. Move it to kern_reboot_table[] where it logically belongs; this ensures that only GLOBAL_ROOT_UID can read/modify this sysctl. Note that this patch doesn't preserve "#ifdef CONFIG_PROC_SYSCTL" around the "cad_pid"; CONFIG_PROC_SYSCTL selects CONFIG_SYSCTL, so it is always set when kern_reboot_table[] is compiled.

A flaw was found in the Linux kernel. A non-root user can exploit a vulnerability in the `sysctl` mechanism, specifically related to the `cad_pid` entry. By unsharing process ID (PID) and user namespaces, a local attacker can modify this global system control from a child namespace. This allows a user without administrative privileges to alter a critical system setting that should only be modifiable by the root user, leading to privilege escalation.

Red Hat Enterprise Linux 10 Not affected kernel Red Hat Enterprise Linux 10 Not affected kernel-rt Red Hat Enterprise Linux 6 Out of support scope kernel Red Hat Enterprise Linux 7 Not affected kernel Red Hat Enterprise Linux 7 Not affected kernel-rt Red Hat Enterprise Linux 8 Not affected kernel Red Hat Enterprise Linux 8 Not affected kernel-rt Red Hat Enterprise Linux 9 Not affected kernel Red Hat Enterprise Linux 9 Not affected kernel-rt Red Hat OpenShift Container Platform 4 Not affected openshift/ose-rhel-coreos-8 Red Hat OpenShift Container Platform 4 Not affected openshift/ose-rhel-coreos-9 https://www.cve.org/CVERecord?id=CVE-2026-80929 https://nvd.nist.gov/vuln/detail/CVE-2026-80929 https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-80929.mbox