CVE-2026-73860

View on CVE.org
Published Nov 6, 2026 CVSS n/a EPSS n/a KEV · Not listed
Description
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-18107. Reason: This candidate is a duplicate of CVE-2026-18107. Notes: All CVE users should reference CVE-2026-18107 instead of this candidate.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
References

No reference.

History
Type Values Removed Values Added
Weaknesses CWE-705
References
Metrics cvssV4_0

{'score': 5.4, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X'}
Type Values Removed Values Added
Description CRIU is a checkpoint and restore tool for Linux. Prior to 4.2.1, CRIU injects a syscall;int3 sequence at the start of the first executable virtual memory area and resumes the target process to execute parasite code. Malicious code in the target process can keep an rseq critical section armed over that injection point so the kernel's restartable-sequence abort redirects execution to an attacker-controlled callback when CRIU resumes the process. In container snapshot environments, the hijacked parasite runs with seccomp disabled and a relaxed AppArmor profile and supplies trusted data to the privileged CRIU process, which can enable higher-privilege code execution. This issue is fixed in version 4.2.1. ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-18107. Reason: This candidate is a duplicate of CVE-2026-18107. Notes: All CVE users should reference CVE-2026-18107 instead of this candidate.
Title CRIU: Parasite hijack triggered by snapshot of malicious software
Metrics cvssV4_0

{'score': 5.4, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

 cvssV4_0

{'score': 5.4, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X'}
Type Values Removed Values Added
First Time appeared Checkpoint-restore
Checkpoint-restore criu
Vendors & Products Checkpoint-restore
Checkpoint-restore criu
Type Values Removed Values Added
Description CRIU is a checkpoint and restore tool for Linux. Prior to 4.2.1, CRIU injects a syscall;int3 sequence at the start of the first executable virtual memory area and resumes the target process to execute parasite code. Malicious code in the target process can keep an rseq critical section armed over that injection point so the kernel's restartable-sequence abort redirects execution to an attacker-controlled callback when CRIU resumes the process. In container snapshot environments, the hijacked parasite runs with seccomp disabled and a relaxed AppArmor profile and supplies trusted data to the privileged CRIU process, which can enable higher-privilege code execution. This issue is fixed in version 4.2.1.
Title CRIU: Parasite hijack triggered by snapshot of malicious software
Weaknesses CWE-705
References
Metrics cvssV4_0

{'score': 5.4, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}
Weaknesses

No weakness.

Sources

Status
REJECTED
Assigner
GitHub_M
Published
Updated
Nov 9, 2026, 2:00 PM
Reserved
Aug 13, 2026, 5:44 PM

View source JSON

Updated

JSON

Status
Rejected
Published
Nov 6, 2026, 8:17 PM
Modified
Nov 9, 2026, 2:17 PM

View source JSON

No data.

No data.