Bug 2451615 (CVE-2026-4878)

Summary: CVE-2026-4878 libcap: libcap: Privilege escalation via TOCTOU race condition in cap_set_file()
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: rhel-process-autobot, security-response-team, sightmistake, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in libcap. A local unprivileged user can exploit a Time-of-check-to-time-of-use (TOCTOU) race condition in the `cap_set_file()` function. This allows an attacker with write access to a parent directory to redirect file capability updates to an attacker-controlled file. By doing so, capabilities can be injected into or stripped from unintended executables, leading to privilege escalation.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2447554, 2481143    
Bug Blocks:    
Deadline: 2026-04-06   

Description OSIDB Bzimport 2026-03-26 06:56:43 UTC 
A time-of-check-to-time-of-use (TOCTOU) race condition in libcap’s cap_set_file() allows a local unprivileged user to redirect file capability updates to an attacker‑controlled file and gain elevated privileges. The function first validates the target path with lstat() (which does not follow symlinks) and enforces that it is a regular, non‑symlink file, but then applies or removes security.capability using setxattr() / removexattr(), which re-resolve the path and do follow symlinks. An attacker with write access to the parent directory can exploit the window between these calls by atomically swapping the validated regular file with a symlink or alternate file using renameat2(RENAME_EXCHANGE). As a result, capabilities can be injected into or stripped from an unintended executable, for example when a privileged process (such as setcap, package scripts, or container tooling) invokes cap_set_file() on an attacker-influenced path. This can be abused to grant capabilities like CAP_SETUID to an attacker’s binary and escalate to root.
Comment 3 errata-xmlrpc 2026-04-30 17:40:30 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:12423 https://access.redhat.com/errata/RHSA-2026:12423
Comment 4 errata-xmlrpc 2026-04-30 18:47:26 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:12441 https://access.redhat.com/errata/RHSA-2026:12441
Comment 5 errata-xmlrpc 2026-05-04 01:38:10 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:13285 https://access.redhat.com/errata/RHSA-2026:13285
Comment 9 errata-xmlrpc 2026-05-19 16:05:02 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:19130 https://access.redhat.com/errata/RHSA-2026:19130
Comment 10 errata-xmlrpc 2026-05-19 21:37:16 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:19346 https://access.redhat.com/errata/RHSA-2026:19346
Comment 11 errata-xmlrpc 2026-05-20 02:16:41 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10.0 Extended Update Support

Via RHSA-2026:19456 https://access.redhat.com/errata/RHSA-2026:19456
Comment 12 errata-xmlrpc 2026-05-20 03:49:25 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.6 Extended Update Support

Via RHSA-2026:19458 https://access.redhat.com/errata/RHSA-2026:19458
Comment 16 errata-xmlrpc 2026-05-26 05:04:43 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.4 Extended Update Support

Via RHSA-2026:20595 https://access.redhat.com/errata/RHSA-2026:20595
Comment 18 errata-xmlrpc 2026-05-27 07:06:30 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions

Via RHSA-2026:21254 https://access.redhat.com/errata/RHSA-2026:21254
Comment 21 errata-xmlrpc 2026-06-03 20:18:25 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.8 Telecommunications Update Service

Via RHSA-2026:22957 https://access.redhat.com/errata/RHSA-2026:22957
Comment 22 restoresturdy 2026-06-05 03:06:21 UTC 
The following items have addressed this issue. Support for Red Hat Enterprise Linux 10.0 Extended Updates https://access.redhat.com/errata/RHSA-2026:22957 https://5letter-words.io
Comment 23 errata-xmlrpc 2026-06-08 02:05:20 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On

Via RHSA-2026:24346 https://access.redhat.com/errata/RHSA-2026:24346
Comment 24 errata-xmlrpc 2026-06-10 09:16:22 UTC 
This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.19

Via RHSA-2026:23245 https://access.redhat.com/errata/RHSA-2026:23245
Comment 26 errata-xmlrpc 2026-06-11 07:53:30 UTC 
This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.15

Via RHSA-2026:23233 https://access.redhat.com/errata/RHSA-2026:23233
Comment 27 errata-xmlrpc 2026-06-17 17:17:32 UTC 
This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.18

Via RHSA-2026:25181 https://access.redhat.com/errata/RHSA-2026:25181
Comment 28 errata-xmlrpc 2026-06-18 15:07:51 UTC 
This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.16

Via RHSA-2026:25044 https://access.redhat.com/errata/RHSA-2026:25044
Comment 30 errata-xmlrpc 2026-06-25 10:38:43 UTC 
This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.13

Via RHSA-2026:26542 https://access.redhat.com/errata/RHSA-2026:26542
Comment 31 errata-xmlrpc 2026-07-01 11:16:05 UTC 
This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.14

Via RHSA-2026:28887 https://access.redhat.com/errata/RHSA-2026:28887
Comment 32 errata-xmlrpc 2026-07-09 08:02:53 UTC 
This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.17

Via RHSA-2026:34098 https://access.redhat.com/errata/RHSA-2026:34098