What’s Vulnerable › Vulnerabilities

CVE-2026-41054: Missing exit out of permission check in haveged could lead to root exploit

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-05-20 · updated 2026-07-24
• Weakness: CWE-305

Description

In `src/havegecmd.c`, the `socket_handler` function performs a credential check on the abstract UNIX socket (`\0/sys/entropy/haveged`). However, while it detects if the connecting user is not root (`cred.uid != 0`) and prepares a negative acknowledgement (`ASCII_NAK`), it **fails to stop execution**. The code proceeds to the `switch` statement, allowing any local unprivileged user to execute privileged commands such as `MAGIC_CHROOT`.

Affected products

• SUSE Container suse/sle-micro-rancher/5.3:latest: from ? before 1.9.14-150400.3.11.1 — fixed in 1.9.14-150400.3.11.1
• SUSE Container suse/sle-micro-rancher/5.4:latest: from ? before 1.9.14-150400.3.11.1 — fixed in 1.9.14-150400.3.11.1
• SUSE Container suse/sle-micro/5.5:latest: from ? before 1.9.14-150400.3.11.1 — fixed in 1.9.14-150400.3.11.1
• SUSE Image SLES15-SP4-SAP-BYOS: from ? before 1.9.14-150400.3.11.1 — fixed in 1.9.14-150400.3.11.1
• SUSE Image SLES15-SP4-SAP-BYOS-Azure: from ? before 1.9.14-150400.3.11.1 — fixed in 1.9.14-150400.3.11.1
• SUSE Image SLES15-SP4-SAP-BYOS-EC2: from ? before 1.9.14-150400.3.11.1 — fixed in 1.9.14-150400.3.11.1
• SUSE Image SLES15-SP4-SAP-BYOS-GCE: from ? before 1.9.14-150400.3.11.1 — fixed in 1.9.14-150400.3.11.1
• SUSE Image SLES15-SP4-SAP-Hardened: from ? before 1.9.14-150400.3.11.1 — fixed in 1.9.14-150400.3.11.1
• SUSE Image SLES15-SP4-SAP-Hardened-BYOS: from ? before 1.9.14-150400.3.11.1 — fixed in 1.9.14-150400.3.11.1
• SUSE Image SLES15-SP4-SAP-Hardened-BYOS-Azure: from ? before 1.9.14-150400.3.11.1 — fixed in 1.9.14-150400.3.11.1
• SUSE Image SLES15-SP4-SAP-Hardened-BYOS-EC2: from ? before 1.9.14-150400.3.11.1 — fixed in 1.9.14-150400.3.11.1
• SUSE Image SLES15-SP4-SAP-Hardened-BYOS-GCE: from ? before 1.9.14-150400.3.11.1 — fixed in 1.9.14-150400.3.11.1
• SUSE Image SLES15-SP4-SAP-Hardened-GCE: from ? before 1.9.14-150400.3.11.1 — fixed in 1.9.14-150400.3.11.1
• SUSE Linux Enterprise Desktop 15 SP7: from ? before 1.9.14-150600.11.6.1 — fixed in 1.9.14-150600.11.6.1
• SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS: from ? before 1.9.14-150400.3.11.1 — fixed in 1.9.14-150400.3.11.1
• SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS: from ? before 1.9.14-150400.3.11.1 — fixed in 1.9.14-150400.3.11.1
• SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS: from ? before 1.9.14-150400.3.11.1 — fixed in 1.9.14-150400.3.11.1
• SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS: from ? before 1.9.14-150400.3.11.1 — fixed in 1.9.14-150400.3.11.1
• SUSE Linux Enterprise High Performance Computing 15 SP7: from ? before 1.9.14-150600.11.6.1 — fixed in 1.9.14-150600.11.6.1
• SUSE Linux Enterprise Micro 5.3: from ? before 1.9.14-150400.3.11.1 — fixed in 1.9.14-150400.3.11.1
• SUSE Linux Enterprise Micro 5.4: from ? before 1.9.14-150400.3.11.1 — fixed in 1.9.14-150400.3.11.1
• SUSE Linux Enterprise Micro 5.5: from ? before 1.9.14-150400.3.11.1 — fixed in 1.9.14-150400.3.11.1
• SUSE Linux Enterprise Module for Basesystem 15 SP7: from ? before 1.9.14-150600.11.6.1 — fixed in 1.9.14-150600.11.6.1
• SUSE Linux Enterprise Server 15 SP4-LTSS: from ? before 1.9.14-150400.3.11.1 — fixed in 1.9.14-150400.3.11.1
• SUSE Linux Enterprise Server 15 SP5-LTSS: from ? before 1.9.14-150400.3.11.1 — fixed in 1.9.14-150400.3.11.1
• SUSE Linux Enterprise Server 15 SP6-LTSS: from ? before 1.9.14-150600.11.6.1 — fixed in 1.9.14-150600.11.6.1
• SUSE Linux Enterprise Server 15 SP7: from ? before 1.9.14-150600.11.6.1 — fixed in 1.9.14-150600.11.6.1
• SUSE Linux Enterprise Server for SAP Applications 15 SP4: from ? before 1.9.14-150400.3.11.1 — fixed in 1.9.14-150400.3.11.1
• SUSE Linux Enterprise Server for SAP Applications 15 SP5: from ? before 1.9.14-150400.3.11.1 — fixed in 1.9.14-150400.3.11.1
• SUSE Linux Enterprise Server for SAP Applications 15 SP6: from ? before 1.9.14-150600.11.6.1 — fixed in 1.9.14-150600.11.6.1

How to fix

Upgrade to a fixed version: SUSE Container suse/sle-micro-rancher/5.3:latest 1.9.14-150400.3.11.1; SUSE Container suse/sle-micro-rancher/5.4:latest 1.9.14-150400.3.11.1; SUSE Container suse/sle-micro/5.5:latest 1.9.14-150400.3.11.1; SUSE Image SLES15-SP4-SAP-BYOS 1.9.14-150400.3.11.1; SUSE Image SLES15-SP4-SAP-BYOS-Azure 1.9.14-150400.3.11.1; SUSE Image SLES15-SP4-SAP-BYOS-EC2 1.9.14-150400.3.11.1; SUSE Image SLES15-SP4-SAP-BYOS-GCE 1.9.14-150400.3.11.1; SUSE Image SLES15-SP4-SAP-Hardened 1.9.14-150400.3.11.1; SUSE Image SLES15-SP4-SAP-Hardened-BYOS 1.9.14-150400.3.11.1; SUSE Image SLES15-SP4-SAP-Hardened-BYOS-Azure 1.9.14-150400.3.11.1; SUSE Image SLES15-SP4-SAP-Hardened-BYOS-EC2 1.9.14-150400.3.11.1; SUSE Image SLES15-SP4-SAP-Hardened-BYOS-GCE 1.9.14-150400.3.11.1. Check the vendor advisory for mitigations.

References

• https://bugzilla.suse.com/show_bug.cgi?id=CVE-2026-41054
• http://www.openwall.com/lists/oss-security/2026/05/19/3
• http://www.openwall.com/lists/oss-security/2026/05/19/4
• http://www.openwall.com/lists/oss-security/2026/05/19/5
• http://www.openwall.com/lists/oss-security/2026/05/20/1
• http://www.openwall.com/lists/oss-security/2026/05/21/17
• http://www.openwall.com/lists/oss-security/2026/05/22/1
• https://lists.debian.org/debian-lts-announce/2026/06/msg00005.html

Get alerted when CVE-2026-41054 or the next vulnerability affects your stack