CVE-2026-86805

Awaiting Analysis Awaiting Analysis - Queue

Race Condition in GNU C Library Dynamic Loader

Publication date: 2026-09-22

Last updated on: 2026-09-23

Assigner: GNU C Library

Description

A time-of-check to time-of-use (TOCTOU) race condition in the dynamic loader (ld.so) of the GNU C Library (glibc) versions 2.14 through 2.44 allows a local attacker to escalate privileges. When expanding $ORIGIN in DT_RPATH for setuid/setgid (AT_SECURE) programs, glibc validates the lexically normalized search path against the trusted directories but then opens the raw, un-normalized path. On systems where the Linux fs.protected_hardlinks sysctl is disabled, a local attacker who hard-links such a program into an attacker-controlled directory and wins a race to replace an intermediate path component with a symbolic link can direct the loader outside the trusted directory, causing it to load an attacker-controlled shared object and execute arbitrary code with the elevated privileges of the program. Exploitation requires an installed setuid or setgid binary whose DT_RPATH uses $ORIGIN followed by ".." traversal that normalizes into a trusted directory, and the ability to hard-link that binary and win the race by swapping a path component for a symbolic link. Major Linux-based OS distributions ship with fs.protected_hardlinks enabled by default and mitigate the vulnerability.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-22

Last Modified

2026-09-23

Generated

2026-10-12

AI Q&A

2026-09-22

EPSS Evaluated

2026-10-11

NVD

CVE-2026-86805

EUVD

EUVD-2026-84540

Affected Vendors & Products

Vendor	Product	Version / Range
gnu	glibc	From 2.14 (inc) to 2.44 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-367	The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.

Attack-Flow Graph

Executive Summary

This is a time-of-check to time-of-use (TOCTOU) race condition in the GNU C Library's dynamic loader (ld.so) affecting versions 2.14 through 2.44. When expanding $ORIGIN in DT_RPATH for setuid/setgid programs, glibc validates the normalized search path but then opens the raw un-normalized path. If the Linux fs.protected_hardlinks sysctl is disabled, an attacker can hard-link a program into a controlled directory and replace a path component with a symbolic link to load a malicious shared object and execute arbitrary code with elevated privileges.

Detection Guidance

Detection requires checking for vulnerable glibc versions (2.14 to 2.44) and setuid/setgid binaries using DT_RPATH with $ORIGIN and '..' traversal. Use 'ldd --version' to check glibc version and 'find / -perm -4000 -o -perm -2000' to locate setuid/setgid binaries. Review their DT_RPATH with 'readelf -d <binary>' for $ORIGIN usage.

Impact Analysis

If exploited, this vulnerability allows a local attacker to gain elevated privileges on your system. This could lead to full system compromise, unauthorized access to sensitive data, or the ability to execute arbitrary commands as a privileged user. The attack requires the ability to hard-link files and win a race condition, making it difficult but not impossible to exploit.

Compliance Impact

This vulnerability primarily affects systems with setuid/setgid binaries using DT_RPATH with $ORIGIN and path traversal. While not directly tied to GDPR or HIPAA, it could lead to unauthorized privilege escalation, potentially compromising data confidentiality and integrity. Compliance may be impacted if such breaches result in unauthorized access to regulated data.

Mitigation Strategies

Immediately update glibc to the latest patched version. Enable fs.protected_hardlinks sysctl if disabled. Remove or restrict setuid/setgid binaries using DT_RPATH with $ORIGIN and '..' traversal. Monitor for suspicious activity and apply vendor patches promptly.

Hi! I’m here to help you understand CVE-2026-86805. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70