CVE-2026-4878

This is a library for getting and setting POSIX.1e (formerly POSIX 6) draft 15 capabilities.

Security Fix(es):

A flaw was found in libcap. A local unprivileged user can exploit a Time-of-check-to-time-of-use (TOCTOU) race condition in the cap_set_file() function. This allows an attacker with write access to a parent directory to redirect file capability updates to an attacker-controlled file. By doing so, capabilities can be injected into or stripped from unintended executables, leading to privilege escalation.(CVE-2026-4878)

Libcap is a library for getting and setting POSIX.1e (formerly POSIX 6) draft 15 capabilities.

Security Fix(es):

• libcap: libcap: Privilege escalation via TOCTOU race condition in cap_set_file() (CVE-2026-4878)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Libcap is a library for getting and setting POSIX.1e (formerly POSIX 6) draft 15 capabilities.

Security Fix(es):

• libcap: libcap: Privilege escalation via TOCTOU race condition in cap_set_file() (CVE-2026-4878)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Libcap is a library for getting and setting POSIX.1e (formerly POSIX 6) draft 15 capabilities.

Security Fix(es):

• libcap: libcap: Privilege escalation via TOCTOU race condition in cap_set_file() (CVE-2026-4878)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Libcap is a library for getting and setting POSIX.1e (formerly POSIX 6) draft 15 capabilities.

Security Fix(es):

• libcap: libcap: Privilege escalation via TOCTOU race condition in cap_set_file() (CVE-2026-4878)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Libcap is a library for getting and setting POSIX.1e (formerly POSIX 6) draft 15 capabilities.

Security Fix(es):

• libcap: libcap: Privilege escalation via TOCTOU race condition in cap_set_file() (CVE-2026-4878)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Root has patched CVE-2026-4878 in the libcap package for Root:Alpine:3.15. Multiple fixed versions available.

Root has patched CVE-2026-4878 in the rootio-libcap2 package for Root:Debian:12. Multiple fixed versions available.

Root has patched CVE-2026-4878 in the rootio-libcap2 package for Root:Debian:13. Multiple fixed versions available.

A flaw was found in libcap. A local unprivileged user can exploit a Time-of-check-to-time-of-use (TOCTOU) race condition in the cap_set_file() function. This allows an attacker with write access to a parent directory to redirect file capability updates to an attacker-controlled file. By doing so, capabilities can be injected into or stripped from unintended executables, leading to privilege escalation.

Libcap is a library for getting and setting POSIX.1e (formerly POSIX 6) draft 15 capabilities.

Security Fix(es):

• libcap: libcap: Privilege escalation via TOCTOU race condition in cap_set_file() (CVE-2026-4878)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Libcap is a library for getting and setting POSIX.1e (formerly POSIX 6) draft 15 capabilities.

Security Fix(es):

• libcap: libcap: Privilege escalation via TOCTOU race condition in cap_set_file() (CVE-2026-4878)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Libcap is a library for getting and setting POSIX.1e (formerly POSIX 6) draft 15 capabilities.

Security Fix(es):

• libcap: libcap: Privilege escalation via TOCTOU race condition in cap_set_file() (CVE-2026-4878)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Libcap is a library for getting and setting POSIX.1e (formerly POSIX 6) draft 15 capabilities.

Security Fix(es):

• libcap: libcap: Privilege escalation via TOCTOU race condition in cap_set_file() (CVE-2026-4878)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Libcap is a library for getting and setting POSIX.1e (formerly POSIX 6) draft 15 capabilities.

Security Fix(es):

• libcap: libcap: Privilege escalation via TOCTOU race condition in cap_set_file() (CVE-2026-4878)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

A flaw was found in libcap. A local unprivileged user can exploit a Time-of-check-to-time-of-use (TOCTOU) race condition in the cap_set_file() function. This allows an attacker with write access to a parent directory to redirect file capability updates to an attacker-controlled file. By doing so, capabilities can be injected into or stripped from unintended executables, leading to privilege escalation.

• SECURITY UPDATE: TOCTOU race in cap_set_file()
  • debian/patches/CVE-2026-4878.patch: lock onto the target file via an O_PATH descriptor and operate via /proc/self/fd/N in libcap/cap_file.c so that file capability changes cannot be redirected to an attacker- controlled file by a local user with write access to a parent directory.
  • CVE-2026-4878

• CVE-2026-4878: fix TOCTOU race in cap_set_file() by performing xattr writes via an O_NOFOLLOW file descriptor instead of the user-supplied path

• CVE-2026-4878: fix TOCTOU race in cap_set_file() by performing xattr writes via an O_NOFOLLOW file descriptor instead of the user-supplied path

• CVE-2026-4878: cap_set_file() TOCTOU race via path-based xattr operations

* SECURITY UPDATE: TOCTOU race condition in cap_set_file()
 - debian/patches/CVE-2026-4878.patch: open the target file and operate
   on /proc/self/fd/N so the inode is locked between the regular-file
   check and the xattr update
 - CVE-2026-4878

* SECURITY UPDATE: TOCTOU race condition in cap_set_file()
 - debian/patches/CVE-2026-4878.patch: open the target file and operate
   on /proc/self/fd/N so the inode is locked between the regular-file
   check and the xattr update
 - CVE-2026-4878

• CVE-2026-4878: cap_set_file() TOCTOU race via path-based xattr operations

• CVE-2026-4878: fix TOCTOU race in cap_set_file() by performing xattr writes via an O_NOFOLLOW file descriptor instead of the user-supplied path

CVE-2026-4878. A flaw was found in libcap. A local unprivileged user can exploit a Time-of-check-to-time-of-use (TOCTOU) race condition in the cap_set_file() function. This allows an attacker with write access to a parent directory to redirect file capability updates to an attacker-controlled file. By doing so, capabilities can be injected into or stripped from unintended executables, leading to privilege escalation.

These are all security issues fixed in the libcap-devel-2.78-1.1 package on the GA media of openSUSE Tumbleweed.

This update for libcap fixes the following issues:

• CVE-2026-4878: local privilege escalation through file capability injection due to TOCTOU race condition in cap_set_file() (bsc#1261809).

This update for libcap fixes the following issue:

• CVE-2026-4878: Address a potential TOCTOU race condition in cap_set_file() (bsc#1261809).

This update for libcap fixes the following issue:

• CVE-2026-4878: Address a potential TOCTOU race condition in cap_set_file() (bsc#1261809).

This update for libcap fixes the following issues:

• CVE-2026-4878: local privilege escalation through file capability injection due to TOCTOU race condition in cap_set_file() (bsc#1261809).

This update for libcap fixes the following issue:

• CVE-2026-4878: local privilege escalation through file capability injection due to TOCTOU race condition in cap_set_file() (bsc#1261809).

This update for libcap fixes the following issues:

• CVE-2026-4878: local privilege escalation through file capability injection due to TOCTOU race condition in cap_set_file() (bsc#1261809).

This update for libcap fixes the following issues:

• CVE-2026-4878: local privilege escalation through file capability injection due to TOCTOU race condition in cap_set_file() (bsc#1261809).

Ali Raza discovered that libcap incorrectly handled file capability updates. A local attacker could possibly use this issue to inject or strip capabilities into arbitrary executables and escalate privileges.

USN-8193-1 fixed a vulnerability in libcap. This update provides the corresponding update for Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS.

Original advisory details:

Ali Raza discovered that libcap incorrectly handled file capability updates. A local attacker could possibly use this issue to inject or strip capabilities into arbitrary executables and escalate privileges.