Description
A flaw was found in libcap. A local unprivileged user can exploit a Time-of-check-to-time-of-use (TOCTOU) race condition in the `cap_set_file()` function. This allows an attacker with write access to a parent directory to redirect file capability updates to an attacker-controlled file. By doing so, capabilities can be injected into or stripped from unintended executables, leading to privilege escalation.
Problem types
Time-of-check Time-of-use (TOCTOU) Race Condition
Product status
0:2.69-7.el10_1.1 (rpm) before *
0:2.69-7.el10_2.1 (rpm) before *
0:2.69-7.el10_0.1 (rpm) before *
0:2.48-6.el8_10.1 (rpm) before *
0:2.48-10.el9_7.1 (rpm) before *
0:2.48-10.el9_8.1 (rpm) before *
0:2.48-10.el9_7.1 (rpm) before *
0:2.48-10.el9_8.1 (rpm) before *
0:2.48-9.el9_2.1 (rpm) before *
0:2.48-9.el9_4.1 (rpm) before *
0:2.48-9.el9_6.1 (rpm) before *
1778101579 (rpm) before *
1778156756 (rpm) before *
2.78-1.1.hum1 (rpm) before *
1778056267 (rpm) before *
1778056233 (rpm) before *
1778056245 (rpm) before *
1779798159 (rpm) before *
1779798164 (rpm) before *
1779798165 (rpm) before *
1779798222 (rpm) before *
Timeline
| 2026-03-26: | Reported to Red Hat. |
| 2026-04-06: | Made public. |
Credits
Red Hat would like to thank Ali Raza for reporting this issue.
References
www.openwall.com/lists/oss-security/2026/04/07/4
www.openwall.com/lists/oss-security/2026/04/07/14
www.openwall.com/lists/oss-security/2026/04/08/9
www.openwall.com/lists/oss-security/2026/04/09/5
www.openwall.com/lists/oss-security/2026/04/09/6
access.redhat.com/errata/RHSA-2026:12423 (RHSA-2026:12423)
access.redhat.com/errata/RHSA-2026:12441 (RHSA-2026:12441)
access.redhat.com/errata/RHSA-2026:13285 (RHSA-2026:13285)
access.redhat.com/errata/RHSA-2026:14162 (RHSA-2026:14162)
access.redhat.com/errata/RHSA-2026:14937 (RHSA-2026:14937)
access.redhat.com/errata/RHSA-2026:19130 (RHSA-2026:19130)
access.redhat.com/errata/RHSA-2026:19346 (RHSA-2026:19346)
access.redhat.com/errata/RHSA-2026:19456 (RHSA-2026:19456)
access.redhat.com/errata/RHSA-2026:19458 (RHSA-2026:19458)
access.redhat.com/errata/RHSA-2026:20595 (RHSA-2026:20595)
access.redhat.com/errata/RHSA-2026:21254 (RHSA-2026:21254)
access.redhat.com/errata/RHSA-2026:21275 (RHSA-2026:21275)
access.redhat.com/errata/RHSA-2026:7473 (RHSA-2026:7473)
access.redhat.com/security/cve/CVE-2026-4878
bugzilla.redhat.com/show_bug.cgi?id=2447554
bugzilla.redhat.com/show_bug.cgi?id=2451615 (RHBZ#2451615)