PT-2026-53805 · Linuxcnc · Linuxcnc

Publicado 2026-06-30 · Atualizado 2026-06-30 · CVE-2026-58302

NVD

CVSS v3.1

8.4

Alta

Vetor base

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

rtapi app in linuxcnc-uspace in LinuxCNC before 2.9.9 allows privilege escalation. It is installed SUID root and loads shared library modules via dlopen() by using a user-supplied module name. Insufficient validation of the module name allows path traversal, enabling an unprivileged local user to load an arbitrary shared library. Because the process retains elevated privileges during module loading, this results in local privilege escalation to root.

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2026-58302

Produtos afetados

Linuxcnc

Referências · 5

• https://github.com/LinuxCNC/linuxcnc/compare/v2.9.8...v2.9.9 · Nota
• https://github.com/LinuxCNC/linuxcnc/commit/00d534c87464a3ed446656998aa02b8abc74b391 · Nota
• https://github.com/LinuxCNC/linuxcnc/commit/ea7cd579d39b586952a42e3da9a26d3e36e7a272 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-58302 · Nota de Segurança
• https://bugs.debian.org/1140943 · Nota