Junglewise Threat Intelligence

CVE-2026-4878: libcap privilege escalation via TOCTOU race condition in cap_set_file

CVE-2026-4878 · Severity: medium · CVSS 6.7 · Published 2026-04-09

Technologies: Red Hat Enterprise Linux 10.0, Red Hat OpenShift Container Platform 4.0, Red Hat Enterprise Linux 8.0, Red Hat Enterprise Linux 9.0. Vendors: Red Hat.

Executive brief

A security vulnerability has been identified in libcap, a standard Linux library used to manage fine-grained system permissions (capabilities). A local attacker can exploit a timing flaw to trick the system into granting administrative-level permissions to unauthorized files. This could allow a standard user to gain full control over the system or disrupt critical security protections.

Technical details

A Time-of-check-to-time-of-use (TOCTOU) race condition exists in the cap_set_file() function within libcap. A local unprivileged attacker with write access to a parent directory can exploit this race to redirect file capability updates to an attacker-controlled file. By manipulating the file system during the window between the library's check and the actual application of capabilities, an attacker can inject capabilities into unauthorized executables or strip them from legitimate ones. This leads to local privilege escalation. Red Hat has released security updates (e.g., RHSA-2026:12423, RHSA-2026:12441) to address this issue across various Enterprise Linux versions.

Affected products

  • libcap project libcap -
  • Red Hat Enterprise Linux 8.0
  • Red Hat Enterprise Linux 9.0
  • Red Hat Enterprise Linux 10.0
  • Red Hat Openshift Container Platform 4.0

Timeline

  • 2026-04-07: disclosed: Initial disclosure on oss-security mailing list
  • 2026-04-09: advisory: CVE-2026-4878 published
  • 2026-04-30: patched: Red Hat released security updates for RHEL 9 and 10

References