Red Hat Patches libcap TOCTOU Privilege Escalation in RHEL 8, 9, and 10

Red Hat disclosed CVE-2026-4878, an Important local privilege-escalation flaw in libcap caused by a time-of-check-to-time-of-use race in the cap_set_file() function. The bug allows a local unprivileged attacker with write access to a parent directory to redirect file capability updates to an attacker-controlled file, potentially injecting or stripping capabilities from unintended executables. Red Hat said the issue can be triggered when privileged processes such as setcap or container tooling operate on attacker-influenced paths, assigned it a CVSS v3 score of 6.7, and classified it as CWE-367. No mitigation meeting Red Hat's criteria was listed, and the issue was credited to Ali Raza.

Red Hat issued security errata across multiple product streams for Red Hat Enterprise Linux 8, 9, and 10, including standard, Extended Update Support, SAP, telecommunications, mission-critical, and Extended Life Cycle channels. Published fixes include libcap-2.69-7.el10_1.1 and 2.69-7.el10_2.1 for RHEL 10, libcap-2.48-10.el9_7.1 and 2.48-10.el9_8.1 for RHEL 9, and libcap-2.48-4.el8_6.1 plus 2.48-5.el8_8.1 for affected RHEL 8 streams. Red Hat advised customers to apply the updated packages through the relevant RHSA advisories to remediate the vulnerability.