{"id":"CVE-2026-73860","kind":"vulnerability","aliases":["CVE-2026-73860"],"related":[],"title":"CRIU: malicious process can hijack checkpoint injection and escalate privileges","description":"CRIU is a checkpoint and restore tool for Linux. Prior to 4.2.1, CRIU injects a syscall;int3 sequence at the start of the first executable virtual memory area and resumes the target process to execute parasite code. Malicious code in the target process can keep an rseq critical section armed over that injection point so the kernel's restartable-sequence abort redirects execution to an attacker-controlled callback when CRIU resumes the process. In container snapshot environments, the hijacked parasite runs with seccomp disabled and a relaxed AppArmor profile and supplies trusted data to the privileged CRIU process, which can enable higher-privilege code execution. This issue is fixed in version 4.2.1.","summary":"CRIU, a Linux checkpoint and restore tool, injects code into a target process during checkpointing. A malicious process can abuse restartable-sequence handling to redirect execution to attacker code when CRIU resumes it, and in container snapshot setups that code can feed trusted data to the privileged CRIU process to gain higher privileges.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["checkpoint-restore","containers","criu","linux","runtime"],"not_affected_if":["criu-not-installed","no-checkpoint-restore-workflows"],"how_to_check":"- Check the installed CRIU version with `criu --version`; versions below `4.2.1` are in the affected range.\n- Look for hosts or containers that run CRIU checkpoint/restore, such as container snapshot or live migration workflows.","fix":"- Upgrade CRIU to `4.2.1`.","status":"open","published_at":"2026-11-06T20:17:25+00:00","first_seen_at":"2026-11-06T20:44:00+00:00","triaged_at":"2026-11-06T20:44:18+00:00","updated_at":"2026-11-06T20:44:18+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-11-06T20:44:18Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade CRIU to `4.2.1`.","reach":"local","title":"CRIU: malicious process can hijack checkpoint injection and escalate privileges","impact":"high","summary":"CRIU, a Linux checkpoint and restore tool, injects code into a target process during checkpointing. A malicious process can abuse restartable-sequence handling to redirect execution to attacker code when CRIU resumes it, and in container snapshot setups that code can feed trusted data to the privileged CRIU process to gain higher privileges.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["criu","linux","containers","checkpoint-restore"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"Attacker code runs with CRIU's privileges, escalating beyond container limits","analyst_note":"","how_to_check":"- Check the installed CRIU version with `criu --version`; versions below `4.2.1` are in the affected range.\n- Look for hosts or containers that run CRIU checkpoint/restore, such as container snapshot or live migration workflows.","plain_action":"","needs_analyst":false,"not_affected_if":["criu-not-installed","no-checkpoint-restore-workflows"],"who_is_affected":"Systems that run CRIU for checkpoint and restore, especially container snapshot environments where processes are checkpointed and restored. Hosts that do not use CRIU are not affected by this flaw.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000713,"input_tokens":4398,"output_tokens":546,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-73860':13A,16A '4.2.1':89C,192C 'abort':139C 'abus':43B 'apparmor':167C 'area':105C 'arm':127C 'attack':52B,145C 'attacker-control':144C 'callback':147C 'checkpoint':6A,18B,27B,38B,81C 'checkpoint-restor':17B 'code':32B,53B,64B,114C,116C,184C 'contain':20B,60B,154C 'control':146C 'critic':125C 'criu':1A,21B,24B,55B,72B,78C,90C,149C,176C 'cve':11A,14A 'data':68B,172C 'disabl':163C 'enabl':180C 'environ':156C 'escal':9A 'execut':50B,102C,112C,141C,185C 'feed':66B 'first':101C 'fix':189C 'gain':75B 'handl':47B 'higher':76B,182C 'higher-privileg':181C 'hijack':5A,158C 'inject':7A,31B,91C,130C 'int3':94C 'issu':187C 'keep':122C 'kernel':134C 'linux':22B,26B,86C 'malici':2A,40B,115C 'memori':104C 'parasit':113C,159C 'point':131C 'prior':87C 'privileg':10A,71B,77B,175C,183C 'process':3A,36B,41B,73B,110C,120C,152C,177C 'profil':168C 'redirect':49B,140C 'relax':166C 'restart':45B,137C 'restartable-sequ':44B,136C 'restor':19B,29B,83C 'resum':56B,107C,150C 'rseq':124C 'run':160C 'runtim':23B 'seccomp':162C 'section':126C 'sequenc':46B,95C,138C 'setup':62B 'snapshot':61B,155C 'start':98C 'suppli':170C 'syscal':93C 'target':35B,109C,119C 'tool':30B,84C 'trust':67B,171C 'version':191C 'virtual':103C","nicknames":[],"mitigations":[],"who_affected":"Systems that run CRIU for checkpoint and restore, especially container snapshot environments where processes are checkpointed and restored. Hosts that do not use CRIU are not affected by this flaw.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["checkpointrestore","containers","criu","linux","medium","runtime"],"campaign_type":null,"search_a":"'-2026':12A,15A '-73860':13A,16A 'checkpoint':6A 'criu':1A 'cve':11A,14A 'escal':9A 'hijack':5A 'inject':7A 'malici':2A 'privileg':10A 'process':3A","search_b":"'abus':43B 'attack':52B 'checkpoint':18B,27B,38B 'checkpoint-restor':17B 'code':32B,53B,64B 'contain':20B,60B 'criu':21B,24B,55B,72B 'data':68B 'execut':50B 'feed':66B 'gain':75B 'handl':47B 'higher':76B 'inject':31B 'linux':22B,26B 'malici':40B 'privileg':71B,77B 'process':36B,41B,73B 'redirect':49B 'restart':45B 'restartable-sequ':44B 'restor':19B,29B 'resum':56B 'runtim':23B 'sequenc':46B 'setup':62B 'snapshot':61B 'target':35B 'tool':30B 'trust':67B","search_c":"'4.2.1':89C,192C 'abort':139C 'apparmor':167C 'area':105C 'arm':127C 'attack':145C 'attacker-control':144C 'callback':147C 'checkpoint':81C 'code':114C,116C,184C 'contain':154C 'control':146C 'critic':125C 'criu':78C,90C,149C,176C 'data':172C 'disabl':163C 'enabl':180C 'environ':156C 'execut':102C,112C,141C,185C 'first':101C 'fix':189C 'higher':182C 'higher-privileg':181C 'hijack':158C 'inject':91C,130C 'int3':94C 'issu':187C 'keep':122C 'kernel':134C 'linux':86C 'malici':115C 'memori':104C 'parasit':113C,159C 'point':131C 'prior':87C 'privileg':175C,183C 'process':110C,120C,152C,177C 'profil':168C 'redirect':140C 'relax':166C 'restart':137C 'restartable-sequ':136C 'restor':83C 'resum':107C,150C 'rseq':124C 'run':160C 'seccomp':162C 'section':126C 'sequenc':95C,138C 'snapshot':155C 'start':98C 'suppli':170C 'syscal':93C 'target':109C,119C 'tool':84C 'trust':171C 'version':191C 'virtual':103C","first_public_at":"2026-07-29T16:48:22+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-73860","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73860","severity":null,"published_at":"2026-11-06T20:17:25+00:00","modified_at":"2026-11-06T20:17:25+00:00","first_seen_at":"2026-11-06T20:44:00+00:00","fetched_at":"2026-11-06T20:44:00+00:00","note":null}],"documents":[{"id":89822,"url":"https://github.com/checkpoint-restore/criu/commit/c34355a7c31494a8be65b32b4410a7539f6c2442","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":89823,"url":"https://github.com/checkpoint-restore/criu/commit/f7dafedda5075fd6509bda67fbce1622e0c87a27","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":89824,"url":"https://github.com/checkpoint-restore/criu/releases/tag/v4.2.1","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":89825,"url":"https://github.com/checkpoint-restore/criu/security/advisories/GHSA-fvqj-jvxf-x3wp","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-07-29T16:48:22+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}