CVE-2026-58088: Race condition in ELF core dump segment counting
The ELF core dump code counted the number of dumpable VM map entries, allocated a buffer for the corresponding program headers, then iterated over the map a second time to populate them. A process sharing the address space via rfork(2) can mutate the map between the two passes, causing the second pass to write program headers past the end of the buffer.
An unprivileged local user sharing an address space with a process that dumps core can trigger an out-of-bounds write on the kernel heap, potentially leading to privilege escalation.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems are exposed when a process can share its address space using rfork(2) and that address space is involved in generating an ELF core dump. An unprivileged local user sharing that address space can trigger the condition.
What must an attacker do to exploit it?
The attacker needs local unprivileged access and must share an address space with a process that dumps core. They must mutate the VM map between the core-dump code's initial count of dumpable entries and its later population of program headers.
What is the potential impact?
Successful exploitation causes an out-of-bounds write on the kernel heap. This may allow privilege escalation.