Privilege Escalation in LinuxCNC's rtapi_app Component

CVE-2026-58302

What is CVE-2026-58302?

The rtapi_app component in LinuxCNC before version 2.9.9 is susceptible to privilege escalation due to its SUID root configuration. This component employs dlopen() to load shared library modules based on user-supplied module names, with inadequate validation. This flaw allows an unprivileged local user to craft a malicious module name, exploiting path traversal vulnerabilities. As a result, an attacker can load arbitrary shared libraries while retaining elevated privileges, potentially granting them root access and compromising system security.

References