EUVD-2026-76252
GHSA-5367-6mxw-83v4
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local PR:L exploitation via namespace unshare; impact limited to redirecting one signal handler with no confidentiality impact and bounded integrity/availability effect.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
6DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
sysctl: move the "cad_pid" entry from pid_table[] to kern_reboot_table[]
cad_pid is global, and kill_cad_pid() is only used in the root namespace.
However, due to pid_table_root_permissions(), a non-root user can unshare pid/user namespaces and modify it from the child namespace. This makes no sense and is simply wrong.
Move it to kern_reboot_table[] where it logically belongs; this ensures that only GLOBAL_ROOT_UID can read/modify this sysctl.
Note that this patch doesn't preserve "#ifdef CONFIG_PROC_SYSCTL" around the "cad_pid"; CONFIG_PROC_SYSCTL selects CONFIG_SYSCTL, so it is always set when kern_reboot_table[] is compiled.
AnalysisAI
Improper sysctl table placement in the Linux kernel allows a local low-privileged user to modify the global cad_pid setting - which controls which process receives the Ctrl-Alt-Delete console signal - by abusing unprivileged user and PID namespace creation. A non-root user can call unshare(CLONE_NEWUSER|CLONE_NEWPID) to gain apparent root privileges in a child namespace and then overwrite the globally-scoped /proc/sys/kernel/cad_pid, even though kill_cad_pid() operates exclusively in the root namespace. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a local user account on a system where unprivileged user namespace creation is permitted (the default on Ubuntu, Fedora, Debian, Arch, and most modern distributions). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD-assigned CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) is materially overstated. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Linux kernel 6.18.50, 7.2.4, or 7.3-rc1 or later, which incorporate the `cad_pid` relocation fix. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit affected Linux kernel versions across the infrastructure and identify all systems with local user access. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today