A flaw was found in glibc, specifically within its dynamic loader (ld.so). A local attacker can exploit a time-of-check to time-of-use (TOCTOU) race condition to escalate privileges and execute arbitrary code. This occurs when the dynamic loader expands $ORIGIN in DT_RPATH for setuid/setgid programs, validating a normalized path but then opening an un-normalized path. By hard-linking such a program and winning a race to swap a path component with a symbolic link, an attacker can direct the loader to an attacker-controlled shared object, gaining elevated privileges. This vulnerability is mitigated on systems with fs.protected_hardlinks enabled.
Last checked: 2026-09-23 06:23 UTC
No exploitation evidence · CISA Coordinator (Assessed 2026-09-22 00:00 UTC)
Fix evidence last checked: 2026-10-02 11:31 UTC
SUSE Linux Enterprise Server 16
SUSE-SU-2026:23934 · Published 2026-09-29