In the Linux kernel, the following vulnerability has been resolved: sysctl: move the "cad_pid" entry from pid_table[] to kern_reboot_table[] cad_pid is global, and kill_cad_pid() is only used in the root namespace. However, due to pid_table_root_permissions(), a non-root user can unshare pid/user namespaces and modify it from the child namespace. This makes no sense and is simply wrong. Move it to kern_reboot_table[] where it logically belongs; this ensures that only GLOBAL_ROOT_UID can read/modify this sysctl. Note that this patch doesn't preserve "#ifdef CONFIG_PROC_SYSCTL" around the "cad_pid"; CONFIG_PROC_SYSCTL selects CONFIG_SYSCTL, so it is always set when kern_reboot_table[] is compiled.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - In the Linux kernel, the following vulnerability has been resolved: sysctl: move the "cad_pid" entry from
    pid_table[] to kern_reboot_table[] cad_pid is global, and kill_cad_pid() is only used in the root
    namespace. However, due to pid_table_root_permissions(), a non-root user can unshare pid/user namespaces
    and modify it from the child namespace. This makes no sense and is simply wrong. Move it to
    kern_reboot_table[] where it logically belongs; this ensures that only GLOBAL_ROOT_UID can read/modify
    this sysctl. Note that this patch doesn't preserve "#ifdef CONFIG_PROC_SYSCTL" around the "cad_pid";
    CONFIG_PROC_SYSCTL selects CONFIG_SYSCTL, so it is always set when kern_reboot_table[] is compiled.
    (CVE-2026-80929)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - sysctl: move the cad_pid entry from pid_table[] to kern_reboot_table[] cad_pid is global, and     kill_cad_pid() is only used in the root namespace. However, due to pid_table_root_permissions(), a non-     root user can unshare pid/user namespaces and modify it from the child namespace. This makes no sense and     is simply wrong. Move it to kern_reboot_table[] where it logically belongs; this ensures that only     GLOBAL_ROOT_UID can read/modify this sysctl. Note that this patch doesn't preserve #ifdef     CONFIG_PROC_SYSCTL around the cad_pid; CONFIG_PROC_SYSCTL selects CONFIG_SYSCTL, so it is always set     when kern_reboot_table[] is compiled. (CVE-2026-80929)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
475187	Google: sys-kernel/cchost-kernel-6_18, sys-kernel/csql-kernel-6_18, sys-kernel/lakitu-kernel-6_18, sys-kernel/lakitu-nc-kernel-6_18: security update to 19999.44.106	Tenable Cloud Security	Google COS Security Checks	Local	high
475187	Google: sys-kernel/cchost-kernel-6_18, sys-kernel/csql-kernel-6_18, sys-kernel/lakitu-kernel-6_18, sys-kernel/lakitu-nc-kernel-6_18: security update to 19999.44.106	Tenable Self-Hosted Container Security	Google COS Security Checks	Local	high
365283	Amazon Linux 2023 : bpftool6.18, kernel6.18, kernel6.18-devel (ALAS2023-2026-3187)	Nessus	Amazon Linux Local Security Checks	Local	medium
345370	Linux Distros Unpatched Vulnerability : CVE-2026-80929	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-80929

high

Tenable Plugins

high

high

medium

high