CVE-2026-80929 sysctl: move the "cad_pid" entry from pid_table[] to kern_reboot_table[]
A non-root user can modify the global cad_pid sysctl via namespace unsharing, potentially leading to privilege escalation or system instability.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-80929?
CVE-2026-80929 is a high-severity vulnerability in Linux, published on 11 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
sysctl: move the "cad_pid" entry from pid_table[] to kern_reboot_table[]
cad_pid is global, and kill_cad_pid() is only used in the root namespace.
However, due to pid_table_root_permissions(), a non-root user can unshare pid/user namespaces and modify it from the child namespace. This makes no sense and is simply wrong.
Move it to kern_reboot_table[] where it logically belongs; this ensures that only GLOBAL_ROOT_UID can read/modify this sysctl.
Note that this patch doesn't preserve "#ifdef CONFIG_PROC_SYSCTL" around the "cad_pid"; CONFIG_PROC_SYSCTL selects CONFIG_SYSCTL, so it is always set when kern_reboot_table[] is compiled.
Which versions are affected by CVE-2026-80929?
How do I fix CVE-2026-80929?
Apply the vendor's patch.
Is CVE-2026-80929 being exploited?
There is no known exploitation of CVE-2026-80929 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-80929, DEBIAN-CVE-2026-80929, GHSA-5367-6mxw-83v4, UBUNTU-CVE-2026-80929.