Executive brief
LinuxCNC, an open-source software system for controlling CNC machines, contains a vulnerability in its RTAPI component. This component is used to provide direct hardware access and runs with elevated system privileges. A local user can exploit this flaw to run their own malicious code with full administrative (root) access, potentially taking complete control of the machine.
Technical details
The rtapi_app component in LinuxCNC's linuxcnc-uspace package is installed with the SUID root bit set to facilitate hardware access. It utilizes dlopen() to load shared library modules based on user-provided names. However, the application fails to sufficiently validate these names, allowing for path traversal (CWE-22) via characters like '../'. A local, unprivileged attacker can exploit this to load an arbitrary shared library from any location on the filesystem. Because the process retains root privileges during the module loading process, this leads to arbitrary code execution as root. The issue is fixed in version 2.9.9 by sanitizing module names to disallow slashes and traversal sequences.
Affected products
- LinuxCNC LinuxCNC before 2.9.9
Timeline
- 2026-06-27: patched: Fixed in version 2.9.9-1 in Debian unstable
- 2026-06-28: disclosed: Reported to Debian bug tracker
- 2026-06-30: advisory: CVE-2026-58302 published