The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes.

CVE-2026-78408 is a privilege escalation vulnerability in the util-linux nsenter utility affecting its --join-cgroup option. When nsenter opens the target cgroup.procs file as root, it leaves the file descriptor open across namespace and credential changes and across execve() calls. The Linux kernel uses the credentials from the original open to authorize later cgroup migrations, meaning a program in an attacker-controlled container can inherit root-level cgroup manipulation capabilities. After a privileged operator invokes --join-cgroup against a malicious target, an unprivileged user inside that environment can migrate arbitrary host processes between cgroups and terminate unrelated root processes. This represents a container escape/host process interference scenario requiring no additional privileges from the attacker beyond control of the target container. The vulnerability is tracked by Red Hat and has an associated GitHub security advisory in the util-linux repository.