Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-80929— sysctl: move the "cad_pid" entry from pid_table[] to kern_reboot_table[]

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会开源的一个操作系统内核。 Linux kernel 6.17版本存在安全漏洞，该漏洞源于pid_table_root_permissions()权限验证不当，非root用户可分离pid/user命名空间并在子命名空间中修改cad_pid，可能导致权限提升。

CVSS 7.8 · High EPSS 0.16% · P5

Affected Version Matrix 8

VendorProduct Version RangeStatus
Linux Linux e054bcbe7e7af2baad3752f1a4916a7fffc0457e< e8527de7fea191fda704792a56081f9009aeec37 affected
e054bcbe7e7af2baad3752f1a4916a7fffc0457e< a09bc4eaa67e1a72df3b6d0beb3afeef1e1fdfcd affected
e054bcbe7e7af2baad3752f1a4916a7fffc0457e< 7170ca01623b399c97f2ae9d3e228badc1f25ea3 affected
6.17 affected
< 6.17 unaffected
6.18.50≤ 6.18.* unaffected
7.2.4≤ 7.2.* unaffected
7.3-rc1≤ * unaffected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-80929

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
sysctl: move the "cad_pid" entry from pid_table[] to kern_reboot_table[]
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: sysctl: move the "cad_pid" entry from pid_table[] to kern_reboot_table[] cad_pid is global, and kill_cad_pid() is only used in the root namespace. However, due to pid_table_root_permissions(), a non-root user can unshare pid/user namespaces and modify it from the child namespace. This makes no sense and is simply wrong. Move it to kern_reboot_table[] where it logically belongs; this ensures that only GLOBAL_ROOT_UID can read/modify this sysctl. Note that this patch doesn't preserve "#ifdef CONFIG_PROC_SYSCTL" around the "cad_pid"; CONFIG_PROC_SYSCTL selects CONFIG_SYSCTL, so it is always set when kern_reboot_table[] is compiled.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会开源的一个操作系统内核。 Linux kernel 6.17版本存在安全漏洞，该漏洞源于pid_table_root_permissions()权限验证不当，非root用户可分离pid/user命名空间并在子命名空间中修改cad_pid，可能导致权限提升。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux e054bcbe7e7af2baad3752f1a4916a7fffc0457e ~ e8527de7fea191fda704792a56081f9009aeec37 -
Linux Linux 6.17 -

II. Public POCs for CVE-2026-80929

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-80929

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-80929 (2)

Vendor Pages for CVE-2026-80929 (1)

Same Patch Batch · Linux · 2026-09-11 · 430 CVEs total

CVE-2026-89526 9.8 CRITICAL svcrdma: Validate Read chunk positions before reconstruction
CVE-2026-89688 9.8 CRITICAL nfsd: drop the stateid, not the stateowner, on seqid_op replay retry
CVE-2026-89689 9.8 CRITICAL nfsd: don't free session slots that are still in use
CVE-2026-89558 9.8 CRITICAL md/raid10: fix still_degraded being inverted in raid10_sync_request()
CVE-2026-89555 9.8 CRITICAL mpls: reload header after pskb_may_pull()
CVE-2026-89550 9.8 CRITICAL SUNRPC: svcauth_gss: enforce krb5 token minimum length
CVE-2026-89551 9.8 CRITICAL SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow
CVE-2026-89546 9.8 CRITICAL SUNRPC: close backchannel before destroying callback service
CVE-2026-89542 9.8 CRITICAL SUNRPC: harden gss_krb5_unwrap_v2 against short tokens
CVE-2026-89541 9.8 CRITICAL SUNRPC: harden gss_unwrap_resp_priv length checks
CVE-2026-89538 9.8 CRITICAL SUNRPC: Reject krb5 v2 wrap tokens with oversized ec field
CVE-2026-89536 9.8 CRITICAL SUNRPC: wait for in-flight client TLS handshake callback
CVE-2026-89533 9.8 CRITICAL svcrdma: Fix offset arithmetic in read_chunk_range
CVE-2026-89530 9.8 CRITICAL svcrdma: Reject inline replies that overflow the pull-up buffer
CVE-2026-89479 9.8 CRITICAL sctp: stop processing a packet once its association is deleted
CVE-2026-89485 9.8 CRITICAL lockd: pin next file across nlm_inspect_file lock-drop
CVE-2026-89482 9.8 CRITICAL nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone
CVE-2026-89478 9.8 CRITICAL sctp: drop a chunk if its transport was removed
CVE-2026-89712 9.8 CRITICAL NFSD: restart ssc_expire_umount walk after dropping nfsd_ssc_lock
CVE-2026-81002 9.8 CRITICAL xdp: fix zero-copy frame layout

Showing top 20 of 430 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-80929

No comments yet

Leave a comment