CVE-2026-73860
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
CRIU before 4.2.1 injects a syscall;int3 sequence at the start of the first executable virtual memory area and resumes the target process to execute parasite code. Malicious code in the target process can keep an rseq critical section armed over the injection point, redirecting execution to an attacker-controlled callback when CRIU resumes the process.
Risk Assessment
In container snapshot environments, the hijacked parasite runs with seccomp disabled and a relaxed AppArmor profile, supplying trusted data to the privileged CRIU process, which can enable higher-privilege code execution. This requires malicious code in the target process.
Recommendation
Upgrade CRIU to version 4.2.1 or later. Restrict the ability to run untrusted processes in container snapshot environments and verify image integrity.
Other vulnerabilities in CRIU
See all- CVE-2015-5228High
The service daemon in CRIU creates log and dump files insecurely, allowing local users to create arbitrary files and take ownership of existing files via unspecified vectors related to a directory path.
- CVE-2026-18107High
A flaw was found in CRIU's handling of restartable sequences (rseq) during checkpoint/restore. A malicious process inside a container can register an rseq critical section that hijacks CRIU's parasite code injection, allowing it to spoof process credentials saved in the checkpoint image. On restore, the container process gains elevated capabilities and zeroed UIDs/GIDs.
Original NVD description (English source)
CRIU is a checkpoint and restore tool for Linux. Prior to 4.2.1, CRIU injects a syscall;int3 sequence at the start of the first executable virtual memory area and resumes the target process to execute parasite code. Malicious code in the target process can keep an rseq critical section armed over that injection point so the kernel's restartable-sequence abort redirects execution to an attacker-controlled callback when CRIU resumes the process. In container snapshot environments, the hijacked parasite runs with seccomp disabled and a relaxed AppArmor profile and supplies trusted data to the privileged CRIU process, which can enable higher-privilege code execution. This issue is fixed in version 4.2.1.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS