CVE-2026-85879: Windows Subsystem for Linux Elevation of Privilege Vulnerability
Time-of-check time-of-use (toctou) race condition in Windows Subsystem for Linux allows an authorized attacker to elevate privileges locally.
Other sources
Windows Subsystem for Linux Elevation of Privilege Vulnerability
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.7.10
Event History
Frequently Asked Questions
What level of access does an attacker need before attempting exploitation?
The attacker must already have local access and low privileges on the affected system. The issue is not described as remotely exploitable.
Does exploitation require user interaction?
No user interaction is required according to the provided severity vector. Exploitation has high attack complexity, indicating additional race-condition timing requirements.
What could a successful exploit allow?
A successful exploit could elevate the authorized local attacker’s privileges. The provided vector indicates high potential impact to confidentiality, integrity, and availability, with scope unchanged.