{"id":"CVE-2026-80929","revision":"6520c40ff9bb4c1db7de2eea21c2cd20","records":[{"revision":"6520c40ff9bb4c1db7de2eea21c2cd20","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-80929","aliases":[],"title":"sysctl: move the \"cad_pid\" entry from pid_table[] to kern_reboot_table[]","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nsysctl: move the \"cad_pid\" entry from pid_table[] to kern_reboot_table[]\n\ncad_pid is global, and kill_cad_pid() is only used in the root namespace.\n\nHowever, due to pid_table_root_permissions(), a non-root user can unshare\npid/user namespaces and modify it from the child namespace. This makes no\nsense and is simply wrong.\n\nMove it to kern_reboot_table[] where it logically belongs; this ensures\nthat only GLOBAL_ROOT_UID can read/modify this sysctl.\n\nNote that this patch doesn't preserve \"#ifdef CONFIG_PROC_SYSCTL\" around\nthe \"cad_pid\"; CONFIG_PROC_SYSCTL selects CONFIG_SYSCTL, so it is always\nset when kern_reboot_table[] is compiled.","state":0,"publishedAt":"2026-09-11T19:42:04.778+00:00","modifiedAt":"2026-10-19T08:45:13.127+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"kernel/pid.c\",\n                        \"kernel/reboot.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"e054bcbe7e7af2baad3752f1a4916a7fffc0457e\",\n                            \"lessThan\": \"e8527de7fea191fda704792a56081f9009aeec37\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"e054bcbe7e7af2baad3752f1a4916a7fffc0457e\",\n                            \"lessThan\": \"a09bc4eaa67e1a72df3b6d0beb3afeef1e1fdfcd\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"e054bcbe7e7af2baad3752f1a4916a7fffc0457e\",\n                            \"lessThan\": \"7170ca01623b399c97f2ae9d3e228badc1f25ea3\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"kernel/pid.c\",\n                        \"kernel/reboot.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"6.17\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"6.17\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.50\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.4\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/e8527de7fea191fda704792a56081f9009aeec37","https://git.kernel.org/stable/c/a09bc4eaa67e1a72df3b6d0beb3afeef1e1fdfcd","https://git.kernel.org/stable/c/7170ca01623b399c97f2ae9d3e228badc1f25ea3"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-80929","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-80929","identifiers":["CVE-2026-80929"]},"retained":false,"historicalAffected":[]}],"coverage":[]}