CVE-2026-86805
Received Received - Intake

Race Condition in GNU C Library Dynamic Loader

Publication date: 2026-09-22

Last updated on: 2026-09-22

Assigner: GNU C Library

Description
A time-of-check to time-of-use (TOCTOU) race condition in the dynamic loader (ld.so) of the GNU C Library (glibc) versions 2.14 through 2.44 allows a local attacker to escalate privileges. When expanding $ORIGIN in DT_RPATH for setuid/setgid (AT_SECURE) programs, glibc validates the lexically normalized search path against the trusted directories but then opens the raw, un-normalized path. On systems where the Linux fs.protected_hardlinks sysctl is disabled, a local attacker who hard-links such a program into an attacker-controlled directory and wins a race to replace an intermediate path component with a symbolic link can direct the loader outside the trusted directory, causing it to load an attacker-controlled shared object and execute arbitrary code with the elevated privileges of the program. Exploitation requires an installed setuid or setgid binary whose DT_RPATH uses $ORIGIN followed by ".." traversal that normalizes into a trusted directory, and the ability to hard-link that binary and win the race by swapping a path component for a symbolic link. Major Linux-based OS distributions ship with fs.protected_hardlinks enabled by default and mitigate the vulnerability.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-22
Last Modified
2026-09-22
Generated
2026-09-22
AI Q&A
2026-09-22
EPSS Evaluated
N/A
NVD
CVE-2026-86805
EUVD
EUVD-2026-84540

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
gnu glibc From 2.14 (inc) to 2.44 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-367 The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a time-of-check to time-of-use (TOCTOU) race condition in the GNU C Library's dynamic loader (ld.so) affecting versions 2.14 through 2.44. When expanding $ORIGIN in DT_RPATH for setuid/setgid programs, glibc validates the normalized search path but then opens the raw un-normalized path. If the Linux fs.protected_hardlinks sysctl is disabled, an attacker can hard-link a program into a controlled directory and replace a path component with a symbolic link to load a malicious shared object and execute arbitrary code with elevated privileges.

Detection Guidance

Detection requires checking for vulnerable glibc versions (2.14 to 2.44) and setuid/setgid binaries using DT_RPATH with $ORIGIN and '..' traversal. Use 'ldd --version' to check glibc version and 'find / -perm -4000 -o -perm -2000' to locate setuid/setgid binaries. Review their DT_RPATH with 'readelf -d <binary>' for $ORIGIN usage.

Impact Analysis

If exploited, this vulnerability allows a local attacker to gain elevated privileges on your system. This could lead to full system compromise, unauthorized access to sensitive data, or the ability to execute arbitrary commands as a privileged user. The attack requires the ability to hard-link files and win a race condition, making it difficult but not impossible to exploit.

Mitigation Strategies

Immediately update glibc to the latest patched version. Enable fs.protected_hardlinks sysctl if disabled. Remove or restrict setuid/setgid binaries using DT_RPATH with $ORIGIN and '..' traversal. Monitor for suspicious activity and apply vendor patches promptly.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-86805. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart