CRIU, a Linux checkpoint/restore utility, injected a software breakpoint at the start of the first executable memory area of suspended processes. Malicious code within the target process can arm a restartable‑sequence (rseq) critical section that redirects the breakpoint to an attacker‑controlled callback. When CRIU resumes the process, the callback executes, allowing the attacker to execute code with higher privileges. This flaw effectively permits privilege escalation from a container snapshot environment.

Affected is the checkpoint-restore CRIU project. Versions prior to 4.2.1 are vulnerable. The vulnerability is present in any environment where CRIU performs checkpoints of running processes, especially containers, and where the target process contains malicious code. Systems using CRIU 4.2.1 or later are not affected.

The CVSS score is 5.4, indicating a moderate severity. The EPSS score is not available, and the flaw is not listed in CISA's KEV catalog. Exploitation requires an attacker who can initiate a CRIU checkpoint of a target process that contains code running with an armed rseq section. In container snapshot environments, the hijacked parasite executes with seccomp disabled and a relaxed AppArmor profile, providing an opportunity to elevate privileges when CRIU supplies trusted data to its privileged process. Because the attack relies on local containment rather than remote network exposure, the risk is mainly for privileged operators or compromised environments.