CVE-2026-4878: Libcap: libcap: privilege escalation via toctou race condition in cap_set_file()

Severity: high (CVSS 7.0 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-04-09 · updated 2026-10-26
Weakness: CWE-367

Description

A flaw was found in libcap. A local unprivileged user can exploit a Time-of-check-to-time-of-use (TOCTOU) race condition in the `cap_set_file()` function. This allows an attacker with write access to a parent directory to redirect file capability updates to an attacker-controlled file. By doing so, capabilities can be injected into or stripped from unintended executables, leading to privilege escalation.

Affected products

Libcap Project Libcap: all versions
Red Hat Enterprise Linux: 8.0, 9.0, 10.0
Red Hat OpenShift Container Platform 4.18: 4.0

References

Get alerted when CVE-2026-4878 or the next vulnerability affects your stack