CVE-2026-58302
rtapi_app in linuxcnc-uspace in LinuxCNC before 2.9.9 allows privilege escalation. It is...
rtapi_app in linuxcnc-uspace in LinuxCNC before 2.9.9 allows privilege escalation. It is installed SUID root and loads shared library modules via dlopen() by using a user-supplied module name. Insufficient validation of the module name allows path traversal, enabling an unprivileged local user to load an arbitrary shared library. Because the process retains elevated privileges during module loading, this results in local privilege escalation to root.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
8.4
rtapi_app in linuxcnc-uspace in LinuxCNC before 2.9.9 allows privilege escalation. It is installed SUID root and loads shared library modules via dlopen() by using a user-supplied module name. Insufficient validation of the module name allows path traversal, enabling an unprivileged local user to load an arbitrary shared library. Because the process retains elevated privileges during module loading, this results in local privilege escalation to root.
- Record
CVE-2026-58302- CVSS 3.1
- 8.4 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-22
- Updated
- 2026-11-02
EUVDEUVD-2026-40241
8.4
rtapi_app in linuxcnc-uspace in LinuxCNC before 2.9.9 allows privilege escalation. It is installed SUID root and loads shared library modules via dlopen() by using a user-supplied module name. Insufficient validation of the module name allows path traversal, enabling an unprivileged local user to load an arbitrary shared library. Because the process retains elevated privileges during module loading, this results in local privilege escalation to root.
- Record
EUVD-2026-40241- CVSS 3.1
- 8.4 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-h3vh-9phr-5gjm
8.4
rtapi_app in linuxcnc-uspace in LinuxCNC before 2.9.9 allows privilege escalation. It is...
rtapi_app in linuxcnc-uspace in LinuxCNC before 2.9.9 allows privilege escalation. It is installed SUID root and loads shared library modules via dlopen() by using a user-supplied module name. Insufficient validation of the module name allows path traversal, enabling an unprivileged local user to load an arbitrary shared library. Because the process retains elevated privileges during module loading, this results in local privilege escalation to root.
- Record
GHSA-h3vh-9phr-5gjm- CVSS 3.1
- 8.4 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-22
- Updated
- 2026-11-02
NVD
8.4
rtapi_app in linuxcnc-uspace in LinuxCNC before 2.9.9 allows privilege escalation. It is installed SUID root and loads shared library modules via dlopen() by using a user-supplied module name. Insufficient validation of the module name allows path traversal, enabling an unprivileged local user to load an arbitrary shared library. Because the process retains elevated privileges during module loading, this results in local privilege escalation to root.
- Record
CVE-2026-58302- CVSS 3.1
- 8.4 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-22
- Updated
- 2026-11-02
OSV
8.4
rtapi_app in linuxcnc-uspace in LinuxCNC before 2.9.9 allows privilege escalation. It is installed SUID root and loads shared library modules via dlopen() by using a user-supplied module name. Insufficient validation of the module name allows path traversal, enabling an unprivileged local user to load an arbitrary shared library. Because the process retains elevated privileges during module loading, this results in local privilege escalation to root.
- Record
CVE-2026-58302- CVSS 3.1
- 8.4 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-22
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-58302
8.4
rtapi_app in linuxcnc-uspace in LinuxCNC before 2.9.9 allows privilege escalation. It is installed SUID root and loads shared library modules via dlopen() by using a user-supplied module name. Insufficient validation of the module name allows path traversal, enabling an unprivileged local user to load an arbitrary shared library. Because the process retains elevated privileges during module loading, this results in local privilege escalation to root.
- Record
DEBIAN-CVE-2026-58302- CVSS 3.1
- 8.4 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-58302
8.4
rtapi_app in linuxcnc-uspace in LinuxCNC before 2.9.9 allows privilege escalation. It is installed SUID root and loads shared library modules via dlopen() by using a user-supplied module name. Insufficient validation of the module name allows path traversal, enabling an unprivileged local user to load an arbitrary shared library. Because the process retains elevated privileges during module loading, this results in local privilege escalation to root.
- Record
UBUNTU-CVE-2026-58302- CVSS 3.1
- 8.4 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
linuxcncDebian:12 |
before 2.9.0~pre1+git20230208.f1270d6ed7-1+deb12u2, plus listed versions 2.9.0~pre1+git20230208.f1270d6ed7-12.9.0~pre1+git20230208.f1270d6ed7-1+deb12u1 |
2.9.0~pre1+git20230208.f1270d6ed7-1+deb12u2 |
linuxcncDebian:13 |
before 1:2.9.4-2+deb13u1, plus listed versions 1:2.9.4-2 |
1:2.9.4-2+deb13u1 |
linuxcncUbuntu:25.10 |
All versions, plus listed versions 1:2.9.4-2ubuntu11:2.9.4-2ubuntu2 |
None known |
linuxcncUbuntu:26.10 |
All versions, plus listed versions 1:2.9.4-2ubuntu4 |
None known |
linuxcncUbuntu:26.04:LTS |
All versions, plus listed versions 1:2.9.4-2ubuntu21:2.9.4-2ubuntu31:2.9.4-2ubuntu4 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-58302 is a high vulnerability (CVSS 8.4) in Linuxcnc, published June 30, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.19%, the 9th percentile. Fixed in linuxcnc 2.9.0~pre1+git20230208.f1270d6ed7-1+deb12u2.
References
github.com/LinuxCNC/linuxcnc/commit/00d534c87464a3ed446656998aa02b8abc74b391
github.com/LinuxCNC/linuxcnc/commit/ea7cd579d39b586952a42e3da9a26d3e36e7a272
github.com/LinuxCNC/linuxcnc/compare/v2.9.8...v2.9.9
bugs.debian.org/1140943
nvd.nist.gov/vuln/detail/CVE-2026-58302
github.com/advisories/GHSA-h3vh-9phr-5gjm