CVE-2026-89766

A flaw was found in the Linux kernel. A local attacker could exploit a race condition in the pidfd subsystem, specifically within the PIDFD_GET_*_NAMESPACE ioctls. This vulnerability occurs because the system does not properly hold a lock (exec_update_lock) during credential checks. This allows an attacker to bypass security restrictions and access sensitive namespace information after a target process has changed its privileges, leading to unauthorized information disclosure.

A TOCTOU race in pidfd namespace ioctls can allow the caller to pass a filesystem credential ptrace check against the targets old credentials and then obtain a namespace file descriptor after the target completes execve with new setuid credentials. This can bypass the intended access decision for PIDFD_GET_*_NAMESPACE and expose namespace information or a namespace handle that should have been denied. For the CVSS the PR:L is used because a local user or local process context is required to use pidfd ioctls and race the target execve path. AC:H is used because reliable triggering depends on a timing window between the ptrace access check and the namespace lookup. The issue is not network reachable and does not indicate memory corruption. Impact is mainly an access control bypass with confidentiality impact and possible limited integrity policy impact through unauthorized namespace fd acquisition.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.