CVE-2026-86805: AT_SECURE programs may load attacker-controlled code via $ORIGIN
A time-of-check to time-of-use (TOCTOU) race condition in the dynamic loader (ld.so) of the GNU C Library (glibc) versions 2.14 through 2.44 allows a local attacker to escalate privileges. When expanding $ORIGIN in DTRPATH for setuid/setgid (ATSECURE) programs, glibc validates the lexically normalized search path against the trusted directories but then opens the raw, un-normalized path. On systems where the Linux fs.protectedhardlinks sysctl is disabled, a local attacker who hard-links such a program into an attacker-controlled directory and wins a race to replace an intermediate path component with a symbolic link can direct the loader outside the trusted directory, causing it to load an attacker-controlled shared object and execute arbitrary code with the elevated privileges of the program.
Exploitation requires an installed setuid or setgid binary whose DTRPATH uses $ORIGIN followed by ".." traversal that normalizes into a trusted directory, and the ability to hard-link that binary and win the race by swapping a path component for a symbolic link. Major Linux-based OS distributions ship with fs.protectedhardlinks enabled by default and mitigate the vulnerability.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Enable the fs.protected_hardlinks sysctl on systems where it is disabled.
Linux fs.protected_hardlinks = enabled
Event History
Frequently Asked Questions
Which systems are realistically exposed?
Exposure requires glibc versions 2.14 through 2.44, an installed setuid or setgid program with a DT_RPATH containing $ORIGIN followed by ".." traversal that normalizes to a trusted directory, and fs.protected_hardlinks disabled. Major Linux-based distributions enable fs.protected_hardlinks by default, which mitigates this issue.
What access and conditions does an attacker need?
The attacker needs local access, the ability to create a hard link to the vulnerable privileged binary, and the ability to win a race while replacing an intermediate path component with a symbolic link. Successful exploitation can load an attacker-controlled shared object and execute code with the program's elevated privileges.
What can be done if glibc cannot be updated immediately?
Ensure the Linux fs.protected_hardlinks sysctl is enabled. This default setting on major Linux distributions mitigates the hard-linking condition needed for exploitation.