CVE-2026-4878

Summary

A flaw was found in libcap. A local unprivileged user can exploit a Time-of-check-to-time-of-use (TOCTOU) race condition in the cap_set_file() function. This allows an attacker with write access to a parent directory to redirect file capability updates to an attacker-controlled file. By doing so, capabilities can be injected into or stripped from unintended executables, leading to privilege escalation.

Affected Software

VendorProductVersion RangeStatus
Red HatRed Hat Enterprise Linux 100:2.69-7.el10_1.1 < *unaffected
Red HatRed Hat Enterprise Linux 100:2.69-7.el10_2.1 < *unaffected
Red HatRed Hat Enterprise Linux 10.0 Extended Update Support0:2.69-7.el10_0.1 < *unaffected
Red HatRed Hat Enterprise Linux 80:2.48-6.el8_10.1 < *unaffected
Red HatRed Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support0:2.48-4.el8_6.1 < *unaffected
Red HatRed Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On0:2.48-4.el8_6.1 < *unaffected
Red HatRed Hat Enterprise Linux 8.8 Telecommunications Update Service0:2.48-5.el8_8.1 < *unaffected
Red HatRed Hat Enterprise Linux 8.8 Update Services for SAP Solutions0:2.48-5.el8_8.1 < *unaffected
Red HatRed Hat Enterprise Linux 90:2.48-10.el9_7.1 < *unaffected
Red HatRed Hat Enterprise Linux 90:2.48-10.el9_8.1 < *unaffected
Red HatRed Hat Enterprise Linux 90:2.48-10.el9_7.1 < *unaffected
Red HatRed Hat Enterprise Linux 90:2.48-10.el9_8.1 < *unaffected
Red HatRed Hat Enterprise Linux 9.2 Update Services for SAP Solutions0:2.48-9.el9_2.1 < *unaffected
Red HatRed Hat Enterprise Linux 9.4 Extended Update Support0:2.48-9.el9_4.1 < *unaffected
Red HatRed Hat Enterprise Linux 9.6 Extended Update Support0:2.48-9.el9_6.1 < *unaffected
Red HatRed Hat OpenShift Container Platform 4.13413.92.202606160406-0 < *unaffected
Red HatRed Hat OpenShift Container Platform 4.14414.92.202606231112-0 < *unaffected
Red HatRed Hat OpenShift Container Platform 4.15415.92.202606030318-0 < *unaffected
Red HatRed Hat OpenShift Container Platform 4.16416.94.202606051757-0 < *unaffected
Red HatRed Hat OpenShift Container Platform 4.18418.94.202606051320-0 < *unaffected
Red HatRed Hat OpenShift Container Platform 4.194.19.9.6.202606031700-0 < *unaffected
Red HatCost Management 41780946239 < *unaffected
Red HatRed Hat AI Inference Server 3.21780681984 < *unaffected
Red HatRed Hat AI Inference Server 3.31782352950 < *unaffected
Red HatRed Hat AI Inference Server 3.31782352919 < *unaffected
Red HatRed Hat AI Inference Server 3.31782353093 < *unaffected
Red HatRed Hat AI Inference Server 3.31782352847 < *unaffected
Red HatRed Hat Discovery 21778101579 < *unaffected
Red HatRed Hat Discovery 21778156756 < *unaffected
Red HatRed Hat Discovery 21782159791 < *unaffected
Red HatRed Hat Discovery 21782166952 < *unaffected
Red HatRed Hat Hardened Images2.78-1.1.hum1 < *unaffected
Red HatRed Hat Insights proxy 1.51780420428 < *unaffected
Red HatRed Hat OpenShift distributed tracing 3.9.31778056267 < *unaffected
Red HatRed Hat OpenShift distributed tracing 3.9.31778056233 < *unaffected
Red HatRed Hat OpenShift distributed tracing 3.9.31778056245 < *unaffected
Red HatRed Hat Update Infrastructure 51779798159 < *unaffected
Red HatRed Hat Update Infrastructure 51779798164 < *unaffected
Red HatRed Hat Update Infrastructure 51779798165 < *unaffected
Red HatRed Hat Update Infrastructure 51779798222 < *unaffected

Weaknesses

  • CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition

Workarounds

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

ADP Enrichment

CVE Program Container

Additional References

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: total

libcap: libcap: Privilege escalation via TOCTOU race condition in cap_set_file()

Additional References

References