Libcap: libcap: privilege escalation via toctou race condition in cap_set_file()

Summary

A flaw was found in libcap. A local unprivileged user can exploit a Time-of-check-to-time-of-use (TOCTOU) race condition in the `cap_set_file()` function. This allows an attacker with write access to a parent directory to redirect file capability updates to an attacker-controlled file. By doing so, capabilities can be injected into or stripped from unintended executables, leading to privilege escalation.

Timeline

1. Apr 9, 2026, 12:00 AM UTCCISA SSVC assessment

   Exploitation: none · Automatable: no · Technical impact: total

2. Apr 9, 2026, 2:49 PM UTCCVE published
3. Oct 14, 2026, 7:09 PM UTCRecord last updated

Affected versions

• libcap

  Version range not reported

• libcap

  Version range not reported

• libcap

  Version range not reported

• libcap

  Version range not reported

• libcap

  Version range not reported

• libcap

  Version range not reported

• libcap

  Version range not reported

• libcap

  Version range not reported

• libcap

  Version range not reported

• libcap

  Version range not reported

• libcap

  Version range not reported

• openshift/ose-rhel-coreos-8

  Version range not reported

• openshift/ose-rhel-coreos-9

  Version range not reported

• openshift/ose-rhel-coreos-9

  Version range not reported

• openshift/ose-rhel-coreos-9

  Version range not reported

• openshift/ose-rhel-coreos-9

  Version range not reported

• openshift/ose-rhel-coreos-9

  Version range not reported

• openshift/ose-rhel-coreos-9

  Version range not reported

• openshift/ose-rhel-coreos-9

  Version range not reported

• cert-manager/jetstack-cert-manager-acmesolver-rhel9

  Version range not reported

• cert-manager/jetstack-cert-manager-rhel9

  Version range not reported

• cert-manager/cert-manager-operator-rhel9

  Version range not reported

• cert-manager/cert-manager-operator-bundle

  Version range not reported

• cert-manager/jetstack-cert-manager-acmesolver-rhel9

  Version range not reported

• cert-manager/jetstack-cert-manager-rhel9

  Version range not reported

• cert-manager/cert-manager-istio-csr-rhel9

  Version range not reported

• cert-manager/cert-manager-operator-rhel9

  Version range not reported

• cert-manager/cert-manager-operator-bundle

  Version range not reported

• cert-manager/cert-manager-trust-manager-rhel9

  Version range not reported

• costmanagement/costmanagement-metrics-rhel9-operator

  Version range not reported

• rhaiis/model-opt-cuda-rhel9

  Version range not reported

• rhaiis/model-opt-cuda-rhel9

  Version range not reported

• rhaiis/vllm-spyre-rhel9

  Version range not reported

• rhaiis/vllm-rocm-rhel9

  Version range not reported

• rhaiis/vllm-cuda-rhel9

  Version range not reported

• discovery/discovery-server-rhel9

  Version range not reported

• discovery/discovery-ui-rhel9

  Version range not reported

• libcap-main

  Version range not reported

• insights-proxy/insights-proxy-container-rhel9

  Version range not reported

• rhai/base-image-neuron-rhel9

  Version range not reported

• rhosdt/opentelemetry-collector-rhel9

  Version range not reported

• rhosdt/opentelemetry-rhel9-operator

  Version range not reported

• rhosdt/opentelemetry-target-allocator-rhel9

  Version range not reported

• rhui5/cds-rhel9

  Version range not reported

• rhui5/haproxy-rhel9

  Version range not reported

• rhui5/installer-rhel9

  Version range not reported

• rhui5/rhua-rhel9

  Version range not reported

• rhui5/cds-kubernetes-tp-rhel9

  Version range not reported

• rhui5/installer-tp-rhel9

  Version range not reported

• rhui5/rhua-tp-rhel9

  Version range not reported

• compat-libcap1

  Version range not reported

• libcap

  Version range not reported

• compat-libcap1

  Version range not reported

• libcap

  Version range not reported

• openshift4/ose-hypershift-rhel9

  Version range not reported

References 25