Vulnpedia
← Search CVEs

CVE-2026-86805

MEDIUM 6.3

Published 2026-09-22 · Last modified 2026-09-23

A time-of-check to time-of-use (TOCTOU) race condition in the dynamic loader (ld.so) of the GNU C Library (glibc) versions 2.14 through 2.44 allows a local attacker to escalate privileges. When expanding $ORIGIN in DT_RPATH for setuid/setgid (AT_SECURE) programs, glibc validates the lexically normalized search path against the trusted directories but then opens the raw, un-normalized path. On systems where the Linux fs.protected_hardlinks sysctl is disabled, a local attacker who hard-links such a program into an attacker-controlled directory and wins a race to replace an intermediate path component with a symbolic link can direct the loader outside the trusted directory, causing it to load an attacker-controlled shared object and execute arbitrary code with the elevated privileges of the program. Exploitation requires an installed setuid or setgid binary whose DT_RPATH uses $ORIGIN followed by ".." traversal that normalizes into a trusted directory, and the ability to hard-link that binary and win the race by swapping a path component for a symbolic link. Major Linux-based OS distributions ship with fs.protected_hardlinks enabled by default and mitigate the vulnerability.

NO EXPLOITATION SIGNALS

No known exploitation, public exploit, or elevated probability at this time. Track for changes.

Exploitation likelihood

0.1%chance of exploitation in 30 days · 1st percentile

○ In CISA KEV ○ Catalogued PoC

Impact if exploited

6.3CVSS 3.1 · MEDIUM

  • ConfidentialityHigh
  • IntegrityHigh
  • AvailabilityLow

What an attacker needs

  • ⚠Access: Requires local access to the host
  • ⚠Privileges: Requires a low-privilege account
  • ⚠User interaction: A user must take an action (click / open a file)
  • ⚠Complexity: Needs a race window or specific setup

✓ lowers the bar for an attacker · ⚠ raises it

Proof of concept

No public PoC is currently catalogued.

Search for new PoCs

Search GitHub now — results may be empty or unverified.

Tracked sources are checked daily for recent CVEs, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.

Data snapshot:

Affected

Vendors The Gnu C Library

Products Glibc

Weakness (CWE)

  • CWE-367: Time-of-check time-of-use (TOCTOU) race condition

CVSS vector

CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:L

References and research data (JSON)

Vendor product assessments

Showing 32 of 1132 vendor product statements; 1100 omitted. Read the full vendor advisory.

  • compat-libpthread-nonshared-0:2.43-8.7.hum1@aarch64 as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=aarch64&distro=hummingbird-20251124&repository_id=public-hummingbird-aarch64-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    Red Hat · CVE-2026-86805 · Updated 2026-09-29T00:16:59+00:00
  • glibc-langpack-ber-0:2.43-8.7.hum1@x86_64 as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=x86_64&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    Red Hat · CVE-2026-86805 · Updated 2026-09-29T00:16:59+00:00
  • glibc-langpack-doi-0:2.43-8.7.hum1@aarch64 as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=aarch64&distro=hummingbird-20251124&repository_id=public-hummingbird-aarch64-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    Red Hat · CVE-2026-86805 · Updated 2026-09-29T00:16:59+00:00
  • glibc-langpack-gl-0:2.43-8.7.hum1@x86_64 as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=x86_64&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    Red Hat · CVE-2026-86805 · Updated 2026-09-29T00:16:59+00:00
  • glibc-langpack-kab-0:2.43-8.7.hum1@x86_64 as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=x86_64&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    Red Hat · CVE-2026-86805 · Updated 2026-09-29T00:16:59+00:00
  • glibc-langpack-mai-0:2.43-8.7.hum1@x86_64 as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=x86_64&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    Red Hat · CVE-2026-86805 · Updated 2026-09-29T00:16:59+00:00
  • glibc-langpack-nl-0:2.43-8.7.hum1@aarch64 as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=aarch64&distro=hummingbird-20251124&repository_id=public-hummingbird-aarch64-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    Red Hat · CVE-2026-86805 · Updated 2026-09-29T00:16:59+00:00
  • glibc-langpack-sc-0:2.43-8.7.hum1@x86_64 as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=x86_64&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    Red Hat · CVE-2026-86805 · Updated 2026-09-29T00:16:59+00:00
  • glibc-langpack-ta-0:2.43-8.7.hum1@x86_64 as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=x86_64&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    Red Hat · CVE-2026-86805 · Updated 2026-09-29T00:16:59+00:00
  • glibc-langpack-vi-0:2.43-8.7.hum1@x86_64 as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=x86_64&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    Red Hat · CVE-2026-86805 · Updated 2026-09-29T00:16:59+00:00
  • sysroot-x86_64-fc43-glibc-0:2.43-8.7.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    Red Hat · CVE-2026-86805 · Updated 2026-09-29T00:16:59+00:00
  • glibc as a component of Red Hat Enterprise Linux 10 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/glibc

    • none available: Affected
    Red Hat · CVE-2026-86805 · Updated 2026-09-29T00:16:59+00:00
  • glibc-langpack-gl as a component of Red Hat Enterprise Linux 10 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/glibc-langpack-gl

    • none available: Affected
    Red Hat · CVE-2026-86805 · Updated 2026-09-29T00:16:59+00:00
  • glibc-langpack-niu as a component of Red Hat Enterprise Linux 10 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/glibc-langpack-niu

    • none available: Affected
    Red Hat · CVE-2026-86805 · Updated 2026-09-29T00:16:59+00:00
  • glibc-langpack-ve as a component of Red Hat Enterprise Linux 10 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/glibc-langpack-ve

    • none available: Affected
    Red Hat · CVE-2026-86805 · Updated 2026-09-29T00:16:59+00:00
  • glibc-langpack-ce as a component of Red Hat Enterprise Linux 8 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/glibc-langpack-ce

    • none available: Affected
    Red Hat · CVE-2026-86805 · Updated 2026-09-29T00:16:59+00:00
  • glibc-langpack-lg as a component of Red Hat Enterprise Linux 8 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/glibc-langpack-lg

    • none available: Affected
    Red Hat · CVE-2026-86805 · Updated 2026-09-29T00:16:59+00:00
  • glibc-langpack-st as a component of Red Hat Enterprise Linux 8 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/glibc-langpack-st

    • none available: Affected
    Red Hat · CVE-2026-86805 · Updated 2026-09-29T00:16:59+00:00
  • glibc-langpack-ayc as a component of Red Hat Enterprise Linux 9 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/glibc-langpack-ayc

    • none available: Affected
    Red Hat · CVE-2026-86805 · Updated 2026-09-29T00:16:59+00:00
  • glibc-langpack-it as a component of Red Hat Enterprise Linux 9 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/glibc-langpack-it

    • none available: Affected
    Red Hat · CVE-2026-86805 · Updated 2026-09-29T00:16:59+00:00
  • glibc-langpack-sah as a component of Red Hat Enterprise Linux 9 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/glibc-langpack-sah

    • none available: Affected
    Red Hat · CVE-2026-86805 · Updated 2026-09-29T00:16:59+00:00
  • openshift/ose-rhel-coreos-9 as a component of Red Hat OpenShift Container Platform 4 · known affected

    Vendor assessment for this product only.

    pkg:oci/ose-rhel-coreos-9?repository_url=registry.redhat.io/openshift/ose-rhel-coreos-9

    • none available: Affected
    Red Hat · CVE-2026-86805 · Updated 2026-09-29T00:16:59+00:00
  • compat-glibc-headers as a component of Red Hat Enterprise Linux 6 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/compat-glibc-headers

    Red Hat · CVE-2026-86805 · Updated 2026-09-29T00:16:59+00:00
  • compat-glibc.src as a component of Red Hat Enterprise Linux 6 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/compat-glibc?arch=src

    Red Hat · CVE-2026-86805 · Updated 2026-09-29T00:16:59+00:00
  • glibc-common as a component of Red Hat Enterprise Linux 6 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/glibc-common

    Red Hat · CVE-2026-86805 · Updated 2026-09-29T00:16:59+00:00
  • glibc-devel as a component of Red Hat Enterprise Linux 6 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/glibc-devel

    Red Hat · CVE-2026-86805 · Updated 2026-09-29T00:16:59+00:00
  • glibc-headers as a component of Red Hat Enterprise Linux 6 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/glibc-headers

    Red Hat · CVE-2026-86805 · Updated 2026-09-29T00:16:59+00:00
  • glibc-utils as a component of Red Hat Enterprise Linux 6 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/glibc-utils

    Red Hat · CVE-2026-86805 · Updated 2026-09-29T00:16:59+00:00
  • glibc.src as a component of Red Hat Enterprise Linux 6 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/glibc?arch=src

    Red Hat · CVE-2026-86805 · Updated 2026-09-29T00:16:59+00:00
  • nscd as a component of Red Hat Enterprise Linux 6 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/nscd

    Red Hat · CVE-2026-86805 · Updated 2026-09-29T00:16:59+00:00
  • compat-glibc-headers as a component of Red Hat Enterprise Linux 7 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/compat-glibc-headers

    Red Hat · CVE-2026-86805 · Updated 2026-09-29T00:16:59+00:00
  • compat-glibc.src as a component of Red Hat Enterprise Linux 7 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/compat-glibc?arch=src

    Red Hat · CVE-2026-86805 · Updated 2026-09-29T00:16:59+00:00

All CVSS metrics

  • MEDIUM 6.3 v3.1 · CNA Primary
    CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:L
  • MEDIUM 6.3 v3.1 · NVD Secondary
    CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:L

References

Advisories

Technical & other

Sources: NVD · CVE.org · EPSS