CVE-2026-73860

Name of the Vulnerable Software and Affected Versions CRIU versions prior to 4.2.1

Description CRIU injects a syscall;int3 sequence at the start of the first executable virtual memory area to execute parasite code upon resuming a target process. Malicious code within the target process can maintain an rseq (restartable sequence) critical section over this injection point. This causes the kernel's restartable-sequence abort to redirect execution to an attacker-controlled callback during the process resumption. In container snapshot environments, the hijacked parasite operates with seccomp disabled and a relaxed AppArmor profile, allowing it to provide trusted data to the privileged CRIU process, which may lead to higher-privilege code execution.

Recommendations Update to version 4.2.1.