Flaw in CRIU Handling of Restartable Sequences in Red Hat Products
CVE-2026-18107
What is CVE-2026-18107?
A security flaw has been identified in CRIU's management of restartable sequences (rseq), which permits a malicious process within a container to register a critical section. This capability allows for the injection of rogue code during the checkpoint phase, effectively compromising the saved process credentials in the checkpoint image. When restored, this malicious process can obtain elevated privileges and manipulate user identifiers (UIDs) and group identifiers (GIDs), posing a significant threat to overall container security. However, the real-world impact on Red Hat products is mitigated by several protective mechanisms, including the requirement for root-level privileges to initiate the checkpoint/restore process, default user namespace enforcement in OpenShift, and additional security measures like SELinux and seccomp filters.