CVE-2026-41054
published 2026-05-20CVE-2026-41054: In `src/havegecmd.c`, the `socket_handler` function performs a credential check on the abstract UNIX socket (`\0/sys/entropy/haveged`). However, while it…
PriorityP346high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.18%
8.1th percentile
In `src/havegecmd.c`, the `socket_handler` function performs a credential check on the abstract UNIX socket (`\0/sys/entropy/haveged`). However, while it detects if the connecting user is not root (`cred.uid != 0`) and prepares a negative acknowledgement (`ASCII_NAK`), it **fails to stop execution**. The code proceeds to the `switch` statement, allowing any local unprivileged user to execute privileged commands such as `MAGIC_CHROOT`.
Affected
35 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| suse | container_suse_sle-micro-rancher_5.3_latest | >= ? < 1.9.14-150400.3.11.1 | 1.9.14-150400.3.11.1 |
| suse | container_suse_sle-micro-rancher_5.4_latest | >= ? < 1.9.14-150400.3.11.1 | 1.9.14-150400.3.11.1 |
| suse | container_suse_sle-micro_5.5_latest | >= ? < 1.9.14-150400.3.11.1 | 1.9.14-150400.3.11.1 |
| suse | image_sles15-sp4-sap-byos | >= ? < 1.9.14-150400.3.11.1 | 1.9.14-150400.3.11.1 |
| suse | image_sles15-sp4-sap-byos-azure | >= ? < 1.9.14-150400.3.11.1 | 1.9.14-150400.3.11.1 |
| suse | image_sles15-sp4-sap-byos-ec2 | >= ? < 1.9.14-150400.3.11.1 | 1.9.14-150400.3.11.1 |
| suse | image_sles15-sp4-sap-byos-gce | >= ? < 1.9.14-150400.3.11.1 | 1.9.14-150400.3.11.1 |
| suse | image_sles15-sp4-sap-hardened | >= ? < 1.9.14-150400.3.11.1 | 1.9.14-150400.3.11.1 |
| suse | image_sles15-sp4-sap-hardened-byos | >= ? < 1.9.14-150400.3.11.1 | 1.9.14-150400.3.11.1 |
| suse | image_sles15-sp4-sap-hardened-byos-azure | >= ? < 1.9.14-150400.3.11.1 | 1.9.14-150400.3.11.1 |
| suse | image_sles15-sp4-sap-hardened-byos-ec2 | >= ? < 1.9.14-150400.3.11.1 | 1.9.14-150400.3.11.1 |
| suse | image_sles15-sp4-sap-hardened-byos-gce | >= ? < 1.9.14-150400.3.11.1 | 1.9.14-150400.3.11.1 |
| suse | image_sles15-sp4-sap-hardened-gce | >= ? < 1.9.14-150400.3.11.1 | 1.9.14-150400.3.11.1 |
| suse | suse_linux_enterprise_desktop_15_sp7 | >= ? < 1.9.14-150600.11.6.1 | 1.9.14-150600.11.6.1 |
| suse | suse_linux_enterprise_high_performance_computing_15_sp4-espos | >= ? < 1.9.14-150400.3.11.1 | 1.9.14-150400.3.11.1 |
| suse | suse_linux_enterprise_high_performance_computing_15_sp4-ltss | >= ? < 1.9.14-150400.3.11.1 | 1.9.14-150400.3.11.1 |
| suse | suse_linux_enterprise_high_performance_computing_15_sp5-espos | >= ? < 1.9.14-150400.3.11.1 | 1.9.14-150400.3.11.1 |
| suse | suse_linux_enterprise_high_performance_computing_15_sp5-ltss | >= ? < 1.9.14-150400.3.11.1 | 1.9.14-150400.3.11.1 |
| suse | suse_linux_enterprise_high_performance_computing_15_sp7 | >= ? < 1.9.14-150600.11.6.1 | 1.9.14-150600.11.6.1 |
| suse | suse_linux_enterprise_micro_5.3 | >= ? < 1.9.14-150400.3.11.1 | 1.9.14-150400.3.11.1 |
| suse | suse_linux_enterprise_micro_5.4 | >= ? < 1.9.14-150400.3.11.1 | 1.9.14-150400.3.11.1 |
| suse | suse_linux_enterprise_micro_5.5 | >= ? < 1.9.14-150400.3.11.1 | 1.9.14-150400.3.11.1 |
| suse | suse_linux_enterprise_module_for_basesystem_15_sp7 | >= ? < 1.9.14-150600.11.6.1 | 1.9.14-150600.11.6.1 |
| suse | suse_linux_enterprise_server_15_sp4-ltss | >= ? < 1.9.14-150400.3.11.1 | 1.9.14-150400.3.11.1 |
| suse | suse_linux_enterprise_server_15_sp5-ltss | >= ? < 1.9.14-150400.3.11.1 | 1.9.14-150400.3.11.1 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-c5g3-m8p9-m3gh: In `src/havegecmd
ghsa_unreviewed·2026-05-20
CVE-2026-41054 [HIGH] CWE-305 GHSA-c5g3-m8p9-m3gh: In `src/havegecmd
In `src/havegecmd.c`, the `socket_handler` function performs a credential check on the abstract UNIX socket (`\0/sys/entropy/haveged`). However, while it detects if the connecting user is not root (`cred.uid != 0`) and prepares a negative acknowledgement (`ASCII_NAK`), it **fails to stop execution**. The code proceeds to the `switch` statement, allowing any local unprivileged user to execute privileged commands such as `MAGIC_CHROOT`.
Ubuntu
haveged vulnerability
vendor_ubuntu·2026-06-01
CVE-2026-41054 haveged vulnerability
Title: haveged vulnerability
Summary: haveged could be made to run programs as an administrator.
It was discovered that haveged incorrectly handled credential
checks on its control socket. A local attacker could possibly
use this issue to execute privileged commands.
Instructions: After a standard system update you need to restart haveged to make
all the necessary changes.
No detection rules found.
No public exploits indexed.
https://bugzilla.suse.com/show_bug.cgi?id=CVE-2026-41054http://www.openwall.com/lists/oss-security/2026/05/19/3http://www.openwall.com/lists/oss-security/2026/05/19/4http://www.openwall.com/lists/oss-security/2026/05/19/5http://www.openwall.com/lists/oss-security/2026/05/20/1http://www.openwall.com/lists/oss-security/2026/05/21/17http://www.openwall.com/lists/oss-security/2026/05/22/1https://lists.debian.org/debian-lts-announce/2026/06/msg00005.html
2026-05-20
Published