UBUNTU-CVE-2026-114155: Race Condition
Time-of-check time-of-use (toctou) race condition in .NET allows an authorized attacker to elevate privileges locally.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/dotnet10to a version that resolves this vulnerability.Fixed in 10.0.115-10.0.15-0ubuntu1~24.04.1 - Upgrade
Upgrade
ubuntu/dotnet10to a version that resolves this vulnerability.Fixed in 10.0.115-10.0.15-0ubuntu1~26.10.1 - Upgrade
Upgrade
ubuntu/dotnet11to a version that resolves this vulnerability.Fixed in 11.0.100-11.0.0-0ubuntu1~26.10.1 - Upgrade
Upgrade
ubuntu/dotnet10to a version that resolves this vulnerability.Fixed in 10.0.115-10.0.15-0ubuntu1~26.04.1
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems running the affected Ubuntu .NET packages are exposed when an authorized local attacker can interact with the vulnerable component. The issue is a local privilege-escalation vulnerability, not a remotely exploitable condition based on the provided vector.
What does an attacker need to exploit it?
An attacker needs local access, low-level privileges, and user interaction. Exploitation also requires winning a time-of-check time-of-use race condition, reflected by the high attack complexity.