https://seclists.org/oss-sec/2026/q3/875: The GNU C Library security advisories update for 2026-09-22

Q: Which systems are realistically exposed to exploitation?

Exposure requires glibc versions 2.14 through 2.44, an installed setuid or setgid program with a DT_RPATH containing $ORIGIN followed by ".." traversal that normalizes to a trusted directory, and Linux fs.protected_hardlinks disabled.

Q: What must a local attacker be able to do?

The attacker must be able to create a hard link to the privileged binary and win a race while replacing an intermediate path component with a symbolic link. This can cause the loader to use a shared object from outside the trusted directory.

Q: How can I identify potentially affected privileged programs?

Review installed setuid and setgid binaries for DT_RPATH values that use $ORIGIN followed by ".." traversal, and check whether fs.protected_hardlinks is disabled. Programs without this RPATH pattern do not meet the stated exploitation requirements.

Published Sep 22, 2026

Updated

Affected Software

1 affected component

GNU GNU C Library (glibc)>=2.14<=2.44

Frequently Asked Questions

Which systems are realistically exposed to exploitation?

Exposure requires glibc versions 2.14 through 2.44, an installed setuid or setgid program with a DT_RPATH containing $ORIGIN followed by ".." traversal that normalizes to a trusted directory, and Linux fs.protected_hardlinks disabled.

What must a local attacker be able to do?

The attacker must be able to create a hard link to the privileged binary and win a race while replacing an intermediate path component with a symbolic link. This can cause the loader to use a shared object from outside the trusted directory.

How can I identify potentially affected privileged programs?

Review installed setuid and setgid binaries for DT_RPATH values that use $ORIGIN followed by ".." traversal, and check whether fs.protected_hardlinks is disabled. Programs without this RPATH pattern do not meet the stated exploitation requirements.