Race Condition Vulnerability in GNU C Library Affecting Linux Distributions

CVE-2026-86805

What is CVE-2026-86805?

A race condition vulnerability exists in the dynamic loader of the GNU C Library (glibc) versions 2.14 to 2.44. This flaw allows local attackers to escalate their privileges by exploiting the time-of-check to time-of-use (TOCTOU) mechanism during the path resolution of setuid/setgid programs. Specifically, when utilizing the $ORIGIN variable in DT_RPATH, glibc performs a validation on the normalized search path against trusted directories. However, it subsequently opens the un-normalized path, permitting an attacker to manipulate the path through hard-linking and timing attacks. If the attacker successfully replaces a path component with a symbolic link before the program is executed, it could lead to the loading of arbitrary code with elevated privileges. This vulnerability is particularly critical when the Linux fs.protected_hardlinks sysctl is disabled, although it is typically enabled by default in major distributions to mitigate such risks.

References