An authenticated local attacker can exploit a sysctl misconfiguration in the Linux kernel to achieve unauthorized privilege escalation and system modification.

The flaw resides in the handling of the cad_pid sysctl entry, which was incorrectly accessible via pid_table. A local, low-privileged user can unshare pid/user namespaces to gain unauthorized modification access to this global variable.

Successful exploitation of this vulnerability allows a local user to potentially impact system stability or perform unauthorized administrative actions by modifying sensitive kernel variables. With a CVSS score of 7.8, this represents a high-risk scenario for multi-user environments, cloud infrastructure, and containerized hosts where user isolation is critical to security.

Immediate Action: Update the Linux kernel to version 6.18.50, 7.2.4, or later immediately to apply the required sysctl namespace isolation fixes.

Proactive Monitoring: Audit system logs for unexpected namespace unsharing events or anomalous sysctl modification attempts by non-privileged accounts.

Compensating Controls: Implement strict kernel hardening policies and limit the ability of non-privileged users to create user namespaces if the business use case does not explicitly require them.

Public Exploit Available: Unknown

Given the potential for privilege escalation, administrators should prioritize patching kernel environments that support multi-user access or container isolation. Applying the vendor-provided updates is the only definitive way to ensure that the cad_pid variable is correctly protected from namespace-based manipulation.