CVE-2026-4878

MEDIUM

Libcap: libcap: privilege escalation via toctou race condition in cap_set_file()

Title source: cna

Description

A flaw was found in libcap. A local unprivileged user can exploit a Time-of-check-to-time-of-use (TOCTOU) race condition in the `cap_set_file()` function. This allows an attacker with write access to a parent directory to redirect file capability updates to an attacker-controlled file. By doing so, capabilities can be injected into or stripped from unintended executables, leading to privilege escalation.

References (40)

Core 40

Core References

Vendor Advisory vendor-advisory x_refsource_redhat

RHSA-2026:22634

https://access.redhat.com/errata/RHSA-2026:22634

Vendor Advisory vendor-advisory x_refsource_redhat

RHSA-2026:22957

https://access.redhat.com/errata/RHSA-2026:22957

Vendor Advisory vendor-advisory x_refsource_redhat

RHSA-2026:25096

https://access.redhat.com/errata/RHSA-2026:25096

Vendor Advisory vendor-advisory x_refsource_redhat

RHSA-2026:23233

https://access.redhat.com/errata/RHSA-2026:23233

Vendor Advisory vendor-advisory x_refsource_redhat

RHSA-2026:23245

https://access.redhat.com/errata/RHSA-2026:23245

Vendor Advisory

https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4878.json

Vendor Advisory vendor-advisory x_refsource_redhat

RHSA-2026:25181

https://access.redhat.com/errata/RHSA-2026:25181

Vendor Advisory vendor-advisory x_refsource_redhat

RHSA-2026:25044

https://access.redhat.com/errata/RHSA-2026:25044

Vendor Advisory vendor-advisory x_refsource_redhat

RHSA-2026:27998

https://access.redhat.com/errata/RHSA-2026:27998

Mailing List

http://www.openwall.com/lists/oss-security/2026/04/07/14

Mailing List

http://www.openwall.com/lists/oss-security/2026/04/07/4

Mailing List

http://www.openwall.com/lists/oss-security/2026/04/08/9

Mailing List

http://www.openwall.com/lists/oss-security/2026/04/09/5

Mailing List

http://www.openwall.com/lists/oss-security/2026/04/09/6

Vendor Advisory vendor-advisory x_refsource_redhat

RHSA-2026:29197

https://access.redhat.com/errata/RHSA-2026:29197

Vendor Advisory vendor-advisory x_refsource_redhat

RHSA-2026:26542

https://access.redhat.com/errata/RHSA-2026:26542

Vendor Advisory vendor-advisory x_refsource_redhat

RHSA-2026:30078

https://access.redhat.com/errata/RHSA-2026:30078

Vendor Advisory vendor-advisory x_refsource_redhat

RHSA-2026:30087

https://access.redhat.com/errata/RHSA-2026:30087

Vendor Advisory vendor-advisory x_refsource_redhat

RHSA-2026:30088

https://access.redhat.com/errata/RHSA-2026:30088

Vendor Advisory vendor-advisory x_refsource_redhat

RHSA-2026:30089

https://access.redhat.com/errata/RHSA-2026:30089

https://bugzilla.redhat.com/show_bug.cgi?id=2447554

Vendor Advisory vendor-advisory x_refsource_redhat

RHSA-2026:12423

https://access.redhat.com/errata/RHSA-2026:12423

Vendor Advisory vendor-advisory x_refsource_redhat

RHSA-2026:12441

https://access.redhat.com/errata/RHSA-2026:12441

Vdb Entry, X_Refsource_Redhat vdb-entry x_refsource_redhat

https://access.redhat.com/security/cve/CVE-2026-4878

Issue Tracking, X_Refsource_Redhat issue-tracking x_refsource_redhat

RHBZ#2451615

https://bugzilla.redhat.com/show_bug.cgi?id=2451615

Vendor Advisory vendor-advisory x_refsource_redhat

RHSA-2026:19456

https://access.redhat.com/errata/RHSA-2026:19456

Vendor Advisory vendor-advisory x_refsource_redhat

RHSA-2026:19458

https://access.redhat.com/errata/RHSA-2026:19458

Vendor Advisory vendor-advisory x_refsource_redhat

RHSA-2026:19346

https://access.redhat.com/errata/RHSA-2026:19346

Vendor Advisory vendor-advisory x_refsource_redhat

RHSA-2026:21254

https://access.redhat.com/errata/RHSA-2026:21254

Vendor Advisory vendor-advisory x_refsource_redhat

RHSA-2026:21275

https://access.redhat.com/errata/RHSA-2026:21275

Vendor Advisory vendor-advisory x_refsource_redhat

RHSA-2026:19130

https://access.redhat.com/errata/RHSA-2026:19130

Vendor Advisory vendor-advisory x_refsource_redhat

RHSA-2026:13285

https://access.redhat.com/errata/RHSA-2026:13285

Vendor Advisory vendor-advisory x_refsource_redhat

RHSA-2026:14162

https://access.redhat.com/errata/RHSA-2026:14162

Vendor Advisory vendor-advisory x_refsource_redhat

RHSA-2026:14937

https://access.redhat.com/errata/RHSA-2026:14937

Vendor Advisory vendor-advisory x_refsource_redhat

RHSA-2026:20595

https://access.redhat.com/errata/RHSA-2026:20595

Vendor Advisory vendor-advisory x_refsource_redhat

RHSA-2026:24346

https://access.redhat.com/errata/RHSA-2026:24346

Vendor Advisory vendor-advisory x_refsource_redhat

RHSA-2026:28887

https://access.redhat.com/errata/RHSA-2026:28887

Vendor Advisory vendor-advisory x_refsource_redhat

RHSA-2026:34098

https://access.redhat.com/errata/RHSA-2026:34098

Vendor Advisory vendor-advisory x_refsource_redhat

RHSA-2026:39981

https://access.redhat.com/errata/RHSA-2026:39981

Vendor Advisory vendor-advisory x_refsource_redhat

RHSA-2026:7473

https://access.redhat.com/errata/RHSA-2026:7473

Scores

CVSS v3 6.7

EPSS 0.0021

EPSS Percentile 10.8%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact total

Details

CWE

CWE-367

Status published

Products (50)

libcap_project/libcap

Red Hat/Cost Management 4 1780946239

Red Hat/Cost Management 4 1783539156

Red Hat/Cost Management Metrics Operator 4 1780946239

Red Hat/Cost Management Metrics Operator 4 1783539156

Red Hat/Red Hat AI Inference Server 3.2 1780681984

Red Hat/Red Hat AI Inference Server 3.3 1782352847

Red Hat/Red Hat AI Inference Server 3.3 1782352919

Red Hat/Red Hat AI Inference Server 3.3 1782352950

Red Hat/Red Hat AI Inference Server 3.3 1782353093

... and 40 more

Published Apr 09, 2026

Tracked Since Apr 09, 2026