Is CVE-2026-18107 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-18107 being exploited in the wild.

How severe is CVE-2026-18107?

High severity, with a CVSS score of 7.8, published 28 July 2026.

Which products and versions are affected?

Red Hat Enterprise Linux 10 affected; Red Hat Enterprise Linux 7 affected; Red Hat Enterprise Linux 8 affected; Red Hat Enterprise Linux 9 affected; and 1 more.

Is there a fix for CVE-2026-18107?

A patch was published on 2026-07-19: Fix merged in CRIU GitHub pull request 3097 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-18107 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-18107?

Check whether you run CRIU community CRIU, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-18107: CRIU privilege escalation via rseq critical section hijack during checkpoint

CVE-2026-18107 · Severity: high · CVSS 7.8 · Published 2026-07-28

A vulnerability in the CRIU utility, which is used for freezing and migrating running containers, could allow a malicious process to gain administrative privileges. By manipulating how the system saves the state of a running program, an attacker can trick the tool into granting the process full system capabilities when it is restarted. While serious, the risk is mitigated in many enterprise environments like OpenShift where security features like SELinux and user namespaces are active by default.

Technologies: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4. Vendors: Red Hat.

Quick answers

Is CVE-2026-18107 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-18107 being exploited in the wild.
How severe is CVE-2026-18107?: High severity, with a CVSS score of 7.8, published 28 July 2026.
Which products and versions are affected?: Red Hat Enterprise Linux 10 affected; Red Hat Enterprise Linux 7 affected; Red Hat Enterprise Linux 8 affected; Red Hat Enterprise Linux 9 affected; and 1 more.
Is there a fix for CVE-2026-18107?: A patch was published on 2026-07-19: Fix merged in CRIU GitHub pull request 3097 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-18107 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-18107?: Check whether you run CRIU community CRIU, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability exists in CRIU's 'compel' component regarding the handling of Restartable Sequences (rseq). When CRIU injects parasite code into a process for checkpointing, a malicious process can register an rseq critical section with a crafted abort handler. This handler can intercept the parasite's execution and patch the 'dump_creds' function to return spoofed credentials (UID 0, full capabilities). Upon restoration, CRIU applies these corrupted credentials to the process. The attack requires the attacker to have code execution within a container and for the host to initiate a checkpoint/restore operation. A fix has been merged into the CRIU development branch to properly abort rseq critical sections before parasite injection.

Affected products

Checkpoint/Restore In Userspace (CRIU) CRIU
Red Hat Red Hat Enterprise Linux 7 affected
Red Hat Red Hat Enterprise Linux 8 affected
Red Hat Red Hat Enterprise Linux 9 affected
Red Hat Red Hat Enterprise Linux 10 affected
Red Hat Red Hat OpenShift Container Platform 4 affected

Timeline

2026-07-19: patched: Fix merged in CRIU GitHub pull request 3097
2026-07-28: disclosed: CVE published and Red Hat bugzilla entry created

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.