CVE-2026-86805
published 2026-09-22CVE-2026-86805: A time-of-check to time-of-use (TOCTOU) race condition in the dynamic loader (ld.so) of the GNU C Library (glibc) versions 2.14 through 2.44 allows a local…
PriorityP334medium6.3CVSS 3.1
AVLACHPRLUIRSUCHIHAL
EPSS
0.10%
0.7th percentile
A time-of-check to time-of-use (TOCTOU) race condition in the dynamic loader (ld.so) of the GNU C Library (glibc) versions 2.14 through 2.44 allows a local attacker to escalate privileges. When expanding $ORIGIN in DT_RPATH for setuid/setgid (AT_SECURE) programs, glibc validates the lexically normalized search path against the trusted directories but then opens the raw, un-normalized path. On systems where the Linux fs.protected_hardlinks sysctl is disabled, a local attacker who hard-links such a program into an attacker-controlled directory and wins a race to replace an intermediate path component with a symbolic link can direct the loader outside the trusted directory, causing it to load an attacker-controlled shared object and execute arbitrary code with the elevated privileges of the program.
Exploitation requires an installed setuid or setgid binary whose DT_RPATH uses $ORIGIN followed by ".." traversal that normalizes into a trusted directory, and the ability to hard-link that binary and win the race by swapping a path component for a symbolic link. Major Linux-based OS distributions ship with fs.protected_hardlinks enabled by default and mitigate the vulnerability.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| openshift | ose-rhel-coreos-8 | — | — |
| openshift | ose-rhel-coreos-9 | — | — |
| the_gnu_c_library | glibc | >= 2.14 < 2.45 | 2.45 |
CVSS provenance
nvdv3.16.3MEDIUMCVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:L
vendor_redhat6.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
GNU glibc up to 2.44 Dynamic Loader ld.so toctou (WID-SEC-2026-3522)
vuldb·2026-10-14·CVSS 6.3
CVE-2026-86805 [MEDIUM] GNU glibc up to 2.44 Dynamic Loader ld.so toctou (WID-SEC-2026-3522)
A vulnerability identified as problematic has been detected in GNU glibc up to 2.44. This affects an unknown function of the file ld.so of the component Dynamic Loader. The manipulation leads to time-of-check time-of-use.
This vulnerability is referenced as CVE-2026-86805. The attack can only be performed from a local environment. No exploit is available.
You should upgrade the affected component.
GHSA
A time-of-check to time-of-use (TOCTOU) race condition in the dynamic loader (ld.so) of the GNU C Library (glibc) versions 2.14 through 2.44 allows a local attacker to escalate privileges.
ghsa_unreviewed·2026-09-22
CVE-2026-86805 [MEDIUM] CWE-367 A time-of-check to time-of-use (TOCTOU) race condition in the dynamic loader (ld.so) of the GNU C Library (glibc) versions 2.14 through 2.44 allows a local attacker to escalate privileges.
A time-of-check to time-of-use (TOCTOU) race condition in the dynamic loader (ld.so) of the GNU C Library (glibc) versions 2.14 through 2.44 allows a local attacker to escalate privileges. When expanding $ORIGIN in DT_RPATH for setuid/setgid (AT_SECURE) programs, glibc validates the lexically normalized search path against the trusted directories but then opens the raw, un-normalized path. On systems where the Linux fs.protected_hardlinks sysctl is disabled, a local attacker who hard-links such a program into an attacker-controlled directory and wins a race to replace an intermediate path component with a symbolic link can direct the loader outside the trusted directory, causing it to load an attacker-controlled shared object and execute arbitrary code with the elevated privileges of the p
Red Hat
glibc: glibc: Privilege escalation and arbitrary code execution via TOCTOU race condition in dynamic loader
vendor_redhat·2026-09-22·CVSS 6.3
CVE-2026-86805 [MEDIUM] CWE-367 glibc: glibc: Privilege escalation and arbitrary code execution via TOCTOU race condition in dynamic loader
glibc: glibc: Privilege escalation and arbitrary code execution via TOCTOU race condition in dynamic loader
A flaw was found in glibc, specifically within its dynamic loader (ld.so). A local attacker can exploit a time-of-check to time-of-use (TOCTOU) race condition to escalate privileges and execute arbitrary code. This occurs when the dynamic loader expands $ORIGIN in DT_RPATH for setuid/setgid programs, validating a normalized path but then opening an un-normalized path. By hard-linking such a program and winning a race to swap a path component with a symbolic link, an attacker can direct the loader to an attacker-controlled shared object, gaining elevated privileges. This vulnerability is mitigated on systems with fs.protected_hardlinks enabled.
Package: openshift/ose-rhel-coreos-8 (
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-09-22
Published