CVE-2026-86805

A flaw was found in glibc, specifically within its dynamic loader (ld.so). A local attacker can exploit a time-of-check to time-of-use (TOCTOU) race condition to escalate privileges and execute arbitrary code. This occurs when the dynamic loader expands $ORIGIN in DT_RPATH for setuid/setgid programs, validating a normalized path but then opening an un-normalized path. By hard-linking such a program and winning a race to swap a path component with a symbolic link, an attacker can direct the loader to an attacker-controlled shared object, gaining elevated privileges. This vulnerability is mitigated on systems with fs.protected_hardlinks enabled.

This vulnerability is rated as Moderate impact for Red Hat products because successful exploitation requires local authenticated access, strict preconditions involving privileged binaries configured with relative runtime library search paths, and winning a timing race. On standard Red Hat Enterprise Linux installations, the kernel protected hardlinks feature is active by default, preventing unprivileged users from hard-linking privileged executables and substantially mitigating exploitation under standard deployment configurations.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.