A flaw in util-linux’s nsenter --join-cgroup option causes the command to open a target process’s cgroup.procs file as root and keep that file descriptor open after the process switches namespaces or changes credentials and after execve. Because the kernel later validates cgroup migrations with the original root credentials, any program that runs inside the attacked namespace can inherit the ability to move host processes between cgroups, including terminating unrelated root processes.

Red Hat Enterprise Linux 10, 7, 8, and 9; Red Hat Hardened Images; Red Hat OpenShift Container Platform 4. The bug exists in the util-linux package used by these systems, and the fix requires upgrading to util‑linux 2.41.6, 2.42.3 or later.

The CVSS score of 7.9 reflects a significant loss of integrity and possible availability impact for the affected systems. EPSS data is unavailable, so the exploitation probability is unknown, but the vulnerability’s nature—open file descriptor leakage combined with privileged credential checks—makes it a high‑risk scenario if the command is used against untrusted targets. The issue is not listed in CISA KEV, yet the impact merits immediate attention. The likely attack vector involves an attacker who can trigger a privileged operator to run nsenter --join-cgroup on a process they can influence, or who gains control of a process after the nsenter call has been executed.