A flaw in CRIU’s handling of restartable sequences allows a malicious process inside a container to register a critical section that hijacks CRIU’s parasite code injection during checkpoint. The hijacked code can spoof the process credentials saved in the checkpoint image, so when the container is restored the process appears with elevated capabilities and zeroed UIDs/GIDs. This gives the container process privileges that it should not have, potentially enabling escape from container boundaries.

The vulnerability affects Red Hat Enterprise Linux 7 through 10 and Red Hat OpenShift Container Platform 4. Containers running on these platforms may be exposed when checkpoint/restore is performed.

The CVSS score of 7.8 indicates a medium–high impact, but the EPSS score of less than 1 % shows that exploitation is currently rare. The flaw cannot be triggered from within the container; it requires root‑privileged podman or cluster‑admin RBAC on OpenShift, and checkpoint/restore is not enabled by default on OpenShift 4.17+. Even if exploited, OpenShift’s default use of user namespaces, SELinux type enforcement, seccomp filters, and kernel mount namespace checks limit the practical effect of spoofed capabilities. The vulnerability is not listed in the CISA KEV catalog, further suggesting a lower likelihood of widespread active exploitation.