Riskcovery

CVE-2026-80929

sysctl: move the "cad_pid" entry from pid_table[] to kern_reboot_table[]

State
Published
Severity
7.8 High
Published
Sep 11, 2026
Updated
Oct 19, 2026
Reserved
Aug 26, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

sysctl: move the "cad_pid" entry from pid_table[] to kern_reboot_table[]

cad_pid is global, and kill_cad_pid() is only used in the root namespace.

However, due to pid_table_root_permissions(), a non-root user can unshare pid/user namespaces and modify it from the child namespace. This makes no sense and is simply wrong.

Move it to kern_reboot_table[] where it logically belongs; this ensures that only GLOBAL_ROOT_UID can read/modify this sysctl.

Note that this patch doesn't preserve "#ifdef CONFIG_PROC_SYSCTL" around the "cad_pid"; CONFIG_PROC_SYSCTL selects CONFIG_SYSCTL, so it is always set when kern_reboot_table[] is compiled.

Scores

CVSSScoreVectorSource
3.17.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HLinux

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • e054bcbe7e7af2baad3752f1a4916a7fffc0457e to before e8527de7fea191fda704792a56081f9009aeec37Affected
  • e054bcbe7e7af2baad3752f1a4916a7fffc0457e to before a09bc4eaa67e1a72df3b6d0beb3afeef1e1fdfcdAffected
  • e054bcbe7e7af2baad3752f1a4916a7fffc0457e to before 7170ca01623b399c97f2ae9d3e228badc1f25ea3Affected
LinuxLinux
  • 6.17Affected
  • before 6.17Not affected
  • 6.18.50 through 6.18.*Not affected
  • 7.2.4 through 7.2.*Not affected
  • 7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.