Loading vulnerability…
Local privilege escalation in libcap cap_set_file()
CVE-2026-4878 is a time-of-check-to-time-of-use (TOCTOU) race condition in libcap's cap_set_file() function. A local unprivileged attacker with write access to a parent directory can race a file capability update and redirect it to an attacker-controlled file. This allows capabilities to be injected into or stripped from unintended executables, potentially enabling privilege escalation.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can compromise executable capability assignments, granting unintended privileges or removing capabilities required for normal operation. Privilege escalation can expose sensitive information, enable unauthorized modification, and disrupt services. The CVSS v3.0 assessment assigns high confidentiality, integrity, and availability impacts, with a base score of 7.0.
If you can’t patch tonight, do this now.
Restrict untrusted users' write access to parent directories of files whose capabilities are modified by privileged processes. Avoid performing privileged capability updates on executables within attacker-writable directory trees. These measures reduce exposure to the required race condition but do not replace the security update; no vulnerability-specific vendor workaround is documented.
Patch, then assume compromise.
Install the vendor-provided libcap security updates and applicable companion packages. Fixed Red Hat builds include 2.48-10.el9_7.1 for RHEL 9 under RHSA-2026:12441 and 2.48-6.el8_10.1 for RHEL 8 under RHSA-2026:13285. Oracle Linux 9 is addressed by ELSA-2026-12441, whose changelog identifies 2.48-10.1 as containing the fix. Use the appropriate patched build for each distribution and supported update stream. For bundled libcap installations, deploy the corresponding fixed product release or image rather than relying solely on host package updates.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
56 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.