uutils coreutils: chroot --userspec resolves the user inside the new root, loading attacker NSS modules as root

Impact

chroot --userspec calls getpwnam() after entering the new root but before dropping privileges, so glibc's name service switch loads libnss_*.so.2 from inside the target directory while still running as root. If the new root is writable by anyone untrusted - a tenant scratch path, an extracted image layer, a staging directory a job wrote - a planted NSS module runs as root on the host. The record frames this as a container escape or local privilege escalation. This matters on nodes where uutils coreutils is the system coreutils (recent Ubuntu images use it by default) and where container build, image unpack or job-prep scripts chroot into tenant-controlled trees; root on a GPU node means the GPU devices, the container runtime and any fabric credentials on that node.

Who can reach it

A local user or job that can write into the directory a privileged script later passes to chroot --userspec. Authentication to the node is needed, and so is a privileged caller using that flag - this is not remotely reachable on its own.

What to do

Update the uutils-coreutils package once your distribution ships the fix; the record points only to the upstream issue and names no fixed version, so verify against your vendor's tracker. Until then, audit privileged automation for chroot --userspec on paths that untrusted workloads can write, and resolve the uid/gid before chrooting instead. Replacing a userspace binary needs no node drain or reboot.

References

Related entries

• sudo: failed setuid/setgid/setgroups before running the mailer is non-fatal, allowing privilege escalationCVE-2026-35535 · sudo (privilege drop before invoking the mailer)High
• QEMU: guest-triggered out-of-bounds write when a physical memory map returns shortCVE-2026-3842 · QEMU (cpu_physical_memory_map short-mapping handling)High
• Linux kernel BPF verifier: atomic-fetch precision gap lets equivalent-looking states be prunedCVE-2026-43009 · Linux kernel BPF verifier (precision backtracking for atomic fetch instructions)High
• Linux kernel sockmap: use-after-free of sk->sk_socket when an AF_UNIX peer is orphanedCVE-2026-43016 · Linux kernel BPF sockmap (sk_psock_verdict_data_ready)High
• Linux kernel BPF verifier: regsafe() wrongly prunes states when old range is BEYOND_PKT_ENDCVE-2026-43030 · Linux kernel BPF verifier (regsafe() packet pointer range comparison)High
• Linux kernel authencesn: out-of-place decrypt writes high-order sequence bits into the destination bufferCVE-2026-43033 · Linux kernel crypto API (authencesn template, out-of-place decryption)High