util-linux EUVD-2026-70105

Exploitation requires two concurrent conditions. First, an unprivileged attacker must control or influence a cgroup target on the host - either through local access to cgroup filesystems or by setting up a container namespace that the attacker manages. Second, a privileged operator (typically root or a user with CAP_SYS_ADMIN) must invoke nsenter --join-cgroup against that attacker-controlled target after the attacker is in position; this is the UI:R interaction in the CVSS vector. The vulnerability does NOT fire passively: the operator's nsenter invocation is the trigger that creates the exploitable fd. What limits exploitation: the attacker must already have a local unprivileged account on the affected host; the privileged operator must specifically use the --join-cgroup flag (not other nsenter namespace options); and the attacker needs to maintain a process alive that can receive or inherit the file descriptor at the moment of execve. Non-default configurations are not required - any Red Hat system with util-linux installed and operators using nsenter --join-cgroup is potentially exposed.

The CVSS 7.9 High score reflects a meaningful but bounded risk: AV:L constrains exploitation to hosts where the attacker already has a local shell, and UI:R requires a privileged operator to run nsenter --join-cgroup targeting an attacker-controlled cgroup - a social-engineering or insider-threat precondition that limits opportunistic mass exploitation. The S:C scope change with I:H/A:H correctly captures the cross-boundary impact: an unprivileged attacker can disrupt root-owned processes on the host, making this a meaningful container-escape adjacent threat in OpenShift environments. EPSS data is not present in the input so exploitation probability cannot be quantified, and KEV status is negative (no confirmed active exploitation). Even a mid-sized municipal IT team in radom running OpenShift workloads should treat this as urgent in environments where untrusted users share container infrastructure with privileged operators who regularly use nsenter. No POC has been identified at time of analysis, which somewhat reduces near-term mass-exploitation risk, but the attack concept is straightforward and the primitive (fd inheritance across execve) is well understood by security researchers.

An attacker with a low-privileged shell on a Red Hat or OpenShift node crafts a cgroup namespace such that it appears to be a legitimate debugging target. When a system administrator or container runtime operator runs nsenter --join-cgroup against that target, the attacker's process inherits the still-open root-owned cgroup.procs fd. The attacker then uses that fd to migrate critical root processes (e.g., system daemons) to a resource-starved cgroup, causing them to be killed by the OOM killer or directly interfering with system availability.