---
id: "CVE-2026-73860"
page: "https://infrastack.ai/live/CVE-2026-73860"
kind: "vulnerability"
aliases: ["CVE-2026-73860"]
title: "CRIU: malicious process can hijack checkpoint injection and escalate privileges"
severity: "medium"
cvss: 5.4
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["checkpoint-restore", "containers", "criu", "linux", "runtime"]
not_affected_if: ["criu-not-installed", "no-checkpoint-restore-workflows"]
published_at: "2026-11-06T20:17:25+00:00"
first_seen_at: "2026-11-06T20:44:00+00:00"
updated_at: "2026-11-06T20:44:18+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-73860", "first_seen_at": "2026-11-06T20:44:00+00:00"}]
exploit_sources: []
---

# CRIU: malicious process can hijack checkpoint injection and escalate privileges

Link for people: https://infrastack.ai/live/CVE-2026-73860 (this .md is for agents)

CRIU, a Linux checkpoint and restore tool, injects code into a target process during checkpointing. A malicious process can abuse restartable-sequence handling to redirect execution to attacker code when CRIU resumes it, and in container snapshot setups that code can feed trusted data to the privileged CRIU process to gain higher privileges.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed CRIU version with `criu --version`; versions below `4.2.1` are in the affected range.
- Look for hosts or containers that run CRIU checkpoint/restore, such as container snapshot or live migration workflows.

## Fix

- Upgrade CRIU to `4.2.1`.

## Timeline

- 2026-11-06T20:44:00+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-73860

## Documents

- [advisory] Vendor advisory: github.com https://github.com/checkpoint-restore/criu/security/advisories/GHSA-fvqj-jvxf-x3wp
- [fix] Patch: github.com https://github.com/checkpoint-restore/criu/commit/c34355a7c31494a8be65b32b4410a7539f6c2442
- [fix] Patch: github.com https://github.com/checkpoint-restore/criu/commit/f7dafedda5075fd6509bda67fbce1622e0c87a27
- [fix] Release notes: github.com https://github.com/checkpoint-restore/criu/releases/tag/v4.2.1

## From the sources

CRIU is a checkpoint and restore tool for Linux. Prior to 4.2.1, CRIU injects a syscall;int3 sequence at the start of the first executable virtual memory area and resumes the target process to execute parasite code. Malicious code in the target process can keep an rseq critical section armed over that injection point so the kernel's restartable-sequence abort redirects execution to an attacker-controlled callback when CRIU resumes the process. In container snapshot environments, the hijacked parasite runs with seccomp disabled and a relaxed AppArmor profile and supplies trusted data to the privileged CRIU process, which can enable higher-privilege code execution. This issue is fixed in version 4.2.1.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_