oss-security - libcap-2.77 (since libcap-2.04) has TOCTOU privilege escalation issue

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <CACmP8U+CbkozUQ1OqxsXMxLgMYvQS85QsWaGtVGBD8BFox34=w@mail.gmail.com>
Date: Mon, 6 Apr 2026 20:22:56 -0700
From: "Andrew G. Morgan" <morgan@...nel.org>
To: oss-security@...ts.openwall.com
Subject: libcap-2.77 (since libcap-2.04) has TOCTOU privilege escalation issue

Hi,

I've just released libcap-2.78 which includes a fix for a TOCTOU issue
in libcap.

The issue has been allocated the following code: CVE-2026-4878. It is
the subject of this private bug:
https://bugzilla.redhat.com/show_bug.cgi?id=2447554 and is also
written up in a github.com advisory which I will publish on Wednesday
(this week). The github advisory tool characterizes the issue as
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H (Severity: Moderate 7 /
10).

The fix for pretty much that whole range of libcap releases is this commit:

https://git.kernel.org/pub/scm/libs/libcap/libcap.git/commit/?id=286ace1259992bd0c5d9016715833f2e148ac596

As the code is publicly available, there is no embargo in place for
releasing fixes.

Cheers

Andrew

PS I tried a few times to post to the private openwall list about this
issue 9 days ago, but my email bounced (likely because I couldn't
effectively follow the mail formatting requirements). I might have
realized that the emails were bounced if gmail hadn't silently placed
the bounced replies in my SPAM folder. Sorry about that.

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.