CVE-2026-4878 Libcap: libcap: privilege escalation via toctou race condition in cap_set_file()

Medium 6.7 Published 9 Apr 2026 Updated 14 Oct 2026

Local attackers can exploit a race condition in libcap to inject capabilities into executables, leading to privilege escalation.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2026-4878?

CVE-2026-4878 is a medium-severity vulnerability in Redhat Enterprise Linux, published on 9 Apr 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

A flaw was found in libcap. A local unprivileged user can exploit a Time-of-check-to-time-of-use (TOCTOU) race condition in the `cap_set_file()` function. This allows an attacker with write access to a parent directory to redirect file capability updates to an attacker-controlled file. By doing so, capabilities can be injected into or stripped from unintended executables, leading to privilege escalation.

Weakness: CWE-367

Which versions are affected by CVE-2026-4878?

It affects 3 products.

Linux distribution packages (40)

`libcap` AlmaLinux:10	All versions	`2.69-7.el10_1.1`
`libcap` AlmaLinux:10	All versions	`2.69-7.el10_2.1`
`libcap-devel` AlmaLinux:10	All versions	`2.69-7.el10_1.1`
`libcap-devel` AlmaLinux:10	All versions	`2.69-7.el10_2.1`
`libcap` AlmaLinux:8	All versions	`2.48-6.el8_10.1`
`libcap-devel` AlmaLinux:8	All versions	`2.48-6.el8_10.1`
`libcap` AlmaLinux:9	All versions	`2.48-10.el9_7.1`
`libcap` AlmaLinux:9	All versions	`2.48-10.el9_8.1`
`libcap-devel` AlmaLinux:9	All versions	`2.48-10.el9_7.1`
`libcap-devel` AlmaLinux:9	All versions	`2.48-10.el9_8.1`
`libcap` Red Hat:enterprise_linux:10.1	All versions	`0:2.69-7.el10_1.1`
`libcap-debuginfo` Red Hat:enterprise_linux:10.1	All versions	`0:2.69-7.el10_1.1`
`libcap-debugsource` Red Hat:enterprise_linux:10.1	All versions	`0:2.69-7.el10_1.1`
`libcap-devel` Red Hat:enterprise_linux:10.1	All versions	`0:2.69-7.el10_1.1`
`libcap` Red Hat:enterprise_linux:10.2	All versions	`0:2.69-7.el10_2.1`
`libcap-debuginfo` Red Hat:enterprise_linux:10.2	All versions	`0:2.69-7.el10_2.1`
`libcap-debugsource` Red Hat:enterprise_linux:10.2	All versions	`0:2.69-7.el10_2.1`
`libcap-devel` Red Hat:enterprise_linux:10.2	All versions	`0:2.69-7.el10_2.1`
`libcap` Red Hat:enterprise_linux:8::baseos	All versions	`0:2.48-6.el8_10.1`
`libcap-debuginfo` Red Hat:enterprise_linux:8::baseos	All versions	`0:2.48-6.el8_10.1`
`libcap-debugsource` Red Hat:enterprise_linux:8::baseos	All versions	`0:2.48-6.el8_10.1`
`libcap-devel` Red Hat:enterprise_linux:8::baseos	All versions	`0:2.48-6.el8_10.1`
`libcap-debuginfo` Red Hat:enterprise_linux:9::appstream	All versions	`0:2.48-10.el9_7.1`
`libcap-debuginfo` Red Hat:enterprise_linux:9::appstream	All versions	`0:2.48-10.el9_8.1`
`libcap-debugsource` Red Hat:enterprise_linux:9::appstream	All versions	`0:2.48-10.el9_7.1`
`libcap-debugsource` Red Hat:enterprise_linux:9::appstream	All versions	`0:2.48-10.el9_8.1`
`libcap-devel` Red Hat:enterprise_linux:9::appstream	All versions	`0:2.48-10.el9_7.1`
`libcap-devel` Red Hat:enterprise_linux:9::appstream	All versions	`0:2.48-10.el9_8.1`
`libcap` Red Hat:enterprise_linux:9::baseos	All versions	`0:2.48-10.el9_7.1`
`libcap` Red Hat:enterprise_linux:9::baseos	All versions	`0:2.48-10.el9_8.1`
`libcap-debuginfo` Red Hat:enterprise_linux:9::baseos	All versions	`0:2.48-10.el9_7.1`
`libcap-debuginfo` Red Hat:enterprise_linux:9::baseos	All versions	`0:2.48-10.el9_8.1`
`libcap-debugsource` Red Hat:enterprise_linux:9::baseos	All versions	`0:2.48-10.el9_7.1`
`libcap-debugsource` Red Hat:enterprise_linux:9::baseos	All versions	`0:2.48-10.el9_8.1`
`libcap` Red Hat:enterprise_linux_eus:10.0	All versions	`0:2.69-7.el10_0.1`
`libcap-debuginfo` Red Hat:enterprise_linux_eus:10.0	All versions	`0:2.69-7.el10_0.1`
`libcap-debugsource` Red Hat:enterprise_linux_eus:10.0	All versions	`0:2.69-7.el10_0.1`
`libcap-devel` Red Hat:enterprise_linux_eus:10.0	All versions	`0:2.69-7.el10_0.1`
`libcap` Red Hat:hummingbird:1	All versions	`0:2.78-1.1.hum1`
`libcap-devel` Red Hat:hummingbird:1	All versions	`0:2.78-1.1.hum1`

Products include Libcap Project Libcap, Redhat Enterprise Linux, Redhat Openshift Container Platform.

How do I fix CVE-2026-4878?

Apply the vendor's patch.

Is CVE-2026-4878 being exploited?

There is no known exploitation of CVE-2026-4878 in the wild and no public exploit code.

Sources

Also known as ALPINE-CVE-2026-4878, ALSA-2026:12423, ALSA-2026:12441, ALSA-2026:13285, ALSA-2026:19130, ALSA-2026:19346 and 45 more.