Skip to content
OpenAdvisories
High · 7.8 CVE-2026-41054 EUVD-2026-31076GHSA-c5g3-m8p9-m3gh

Missing exit out of permission check in haveged could lead to root exploit

Published May 20, 2026 · Updated Jun 5, 2026 · Assigned by suse

Vendor: SUSE Product: Container suse/sle-micro-rancher/5.3:latest Product: Container suse/sle-micro-rancher/5.4:latest Product: Container suse/sle-micro/5.5:latest Product: Image SLES15-SP4-SAP-BYOS Product: Image SLES15-SP4-SAP-BYOS-Azure Product: Image SLES15-SP4-SAP-BYOS-EC2 Product: Image SLES15-SP4-SAP-BYOS-GCE Product: Image SLES15-SP4-SAP-Hardened Product: Image SLES15-SP4-SAP-Hardened-BYOS Product: Image SLES15-SP4-SAP-Hardened-BYOS-Azure Product: Image SLES15-SP4-SAP-Hardened-BYOS-EC2 Product: Image SLES15-SP4-SAP-Hardened-BYOS-GCE Product: Image SLES15-SP4-SAP-Hardened-GCE Product: SUSE Linux Enterprise Desktop 15 SP7 Product: SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS Product: SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS Product: SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS Product: SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS Product: SUSE Linux Enterprise High Performance Computing 15 SP7 Product: SUSE Linux Enterprise Micro 5.3 Product: SUSE Linux Enterprise Micro 5.4 Product: SUSE Linux Enterprise Micro 5.5 Product: SUSE Linux Enterprise Module for Basesystem 15 SP7 Product: SUSE Linux Enterprise Server 15 SP4-LTSS Product: SUSE Linux Enterprise Server 15 SP5-LTSS Product: SUSE Linux Enterprise Server 15 SP6-LTSS Product: SUSE Linux Enterprise Server 15 SP7 Product: SUSE Linux Enterprise Server for SAP Applications 15 SP4 Product: SUSE Linux Enterprise Server for SAP Applications 15 SP5 Product: SUSE Linux Enterprise Server for SAP Applications 15 SP6 Product: SUSE Linux Enterprise Server for SAP Applications 15 SP7 Product: SUSE Manager Proxy LTS 4.3 Product: SUSE Manager Retail Branch Server LTS 4.3 Product: SUSE Manager Server LTS 4.3 Package: haveged Package: haveged Package: haveged Package: haveged Platform: Linux Ecosystem: Alpine Ecosystem: Azure Linux Ecosystem: Debian Ecosystem: Ubuntu

Description

In `src/havegecmd.c`, the `socket_handler` function performs a credential check on the abstract UNIX socket (`\0/sys/entropy/haveged`). However, while it detects if the connecting user is not root (`cred.uid != 0`) and prepares a negative acknowledgement (`ASCII_NAK`), it **fails to stop execution**. The code proceeds to the `switch` statement, allowing any local unprivileged user to execute privileged commands such as `MAGIC_CHROOT`.

Affected products

VendorProductAffectedFixed
SUSE Container suse/sle-micro-rancher/5.3:latest ? – < 1.9.14-150400.3.11.1 1.9.14-150400.3.11.1
SUSE Container suse/sle-micro-rancher/5.4:latest ? – < 1.9.14-150400.3.11.1 1.9.14-150400.3.11.1
SUSE Container suse/sle-micro/5.5:latest ? – < 1.9.14-150400.3.11.1 1.9.14-150400.3.11.1
SUSE Image SLES15-SP4-SAP-BYOS ? – < 1.9.14-150400.3.11.1 1.9.14-150400.3.11.1
SUSE Image SLES15-SP4-SAP-BYOS-Azure ? – < 1.9.14-150400.3.11.1 1.9.14-150400.3.11.1
SUSE Image SLES15-SP4-SAP-BYOS-EC2 ? – < 1.9.14-150400.3.11.1 1.9.14-150400.3.11.1
SUSE Image SLES15-SP4-SAP-BYOS-GCE ? – < 1.9.14-150400.3.11.1 1.9.14-150400.3.11.1
SUSE Image SLES15-SP4-SAP-Hardened ? – < 1.9.14-150400.3.11.1 1.9.14-150400.3.11.1
SUSE Image SLES15-SP4-SAP-Hardened-BYOS ? – < 1.9.14-150400.3.11.1 1.9.14-150400.3.11.1
SUSE Image SLES15-SP4-SAP-Hardened-BYOS-Azure ? – < 1.9.14-150400.3.11.1 1.9.14-150400.3.11.1
SUSE Image SLES15-SP4-SAP-Hardened-BYOS-EC2 ? – < 1.9.14-150400.3.11.1 1.9.14-150400.3.11.1
SUSE Image SLES15-SP4-SAP-Hardened-BYOS-GCE ? – < 1.9.14-150400.3.11.1 1.9.14-150400.3.11.1
SUSE Image SLES15-SP4-SAP-Hardened-GCE ? – < 1.9.14-150400.3.11.1 1.9.14-150400.3.11.1
SUSE SUSE Linux Enterprise Desktop 15 SP7 ? – < 1.9.14-150600.11.6.1 1.9.14-150600.11.6.1
SUSE SUSE Linux Enterprise High Performance Computing 15 SP7 ? – < 1.9.14-150600.11.6.1 1.9.14-150600.11.6.1
SUSE SUSE Linux Enterprise Module for Basesystem 15 SP7 ? – < 1.9.14-150600.11.6.1 1.9.14-150600.11.6.1
SUSE SUSE Linux Enterprise Server 15 SP7 ? – < 1.9.14-150600.11.6.1 1.9.14-150600.11.6.1
SUSE SUSE Linux Enterprise Server for SAP Applications 15 SP7 ? – < 1.9.14-150600.11.6.1 1.9.14-150600.11.6.1
SUSE SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS ? – < 1.9.14-150400.3.11.1 1.9.14-150400.3.11.1
SUSE SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS ? – < 1.9.14-150400.3.11.1 1.9.14-150400.3.11.1
SUSE SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS ? – < 1.9.14-150400.3.11.1 1.9.14-150400.3.11.1
SUSE SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS ? – < 1.9.14-150400.3.11.1 1.9.14-150400.3.11.1
SUSE SUSE Linux Enterprise Micro 5.3 ? – < 1.9.14-150400.3.11.1 1.9.14-150400.3.11.1
SUSE SUSE Linux Enterprise Micro 5.4 ? – < 1.9.14-150400.3.11.1 1.9.14-150400.3.11.1
SUSE SUSE Linux Enterprise Micro 5.5 ? – < 1.9.14-150400.3.11.1 1.9.14-150400.3.11.1
SUSE SUSE Linux Enterprise Server 15 SP4-LTSS ? – < 1.9.14-150400.3.11.1 1.9.14-150400.3.11.1
SUSE SUSE Linux Enterprise Server 15 SP5-LTSS ? – < 1.9.14-150400.3.11.1 1.9.14-150400.3.11.1
SUSE SUSE Linux Enterprise Server 15 SP6-LTSS ? – < 1.9.14-150600.11.6.1 1.9.14-150600.11.6.1
SUSE SUSE Linux Enterprise Server for SAP Applications 15 SP4 ? – < 1.9.14-150400.3.11.1 1.9.14-150400.3.11.1
SUSE SUSE Linux Enterprise Server for SAP Applications 15 SP5 ? – < 1.9.14-150400.3.11.1 1.9.14-150400.3.11.1
SUSE SUSE Linux Enterprise Server for SAP Applications 15 SP6 ? – < 1.9.14-150600.11.6.1 1.9.14-150600.11.6.1
SUSE SUSE Manager Proxy LTS 4.3 ? – < 1.9.14-150400.3.11.1 1.9.14-150400.3.11.1
SUSE SUSE Manager Retail Branch Server LTS 4.3 ? – < 1.9.14-150400.3.11.1 1.9.14-150400.3.11.1
SUSE SUSE Manager Server LTS 4.3 ? – < 1.9.14-150400.3.11.1 1.9.14-150400.3.11.1

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 haveged 1.9.21-1 —
Debian 13 haveged 1.9.19-12+deb13u1 —
Debian 12 haveged 1.9.14-1+deb12u1 —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.04 LTS haveged 1.9.19-14ubuntu0.1 USN-8358-1
Ubuntu 25.10 haveged 1.9.19-12+deb13u1build0.25.10.1 USN-8358-1
Show 2 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 24.04 LTS haveged 1.9.14-1ubuntu2+esm1~24.04.1 USN-8358-1
Ubuntu Pro 22.04 LTS haveged 1.9.14-1ubuntu1+esm1~22.04.1 USN-8358-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed haveged 1.9.21-1.1 openSUSE-SU-2026:10833-1
openSUSE Leap 16.0 haveged 1.9.19-bp160.2.1 openSUSE-SU-2026:21958-1

Alpine

Security tracker ↗
ReleasePackageFixed inAdvisory
Alpine v3.24 haveged 1.9.21-r0 —
Alpine v3.23 haveged 1.9.21-r0 —
Alpine v3.22 haveged 1.9.21-r0 —
Alpine v3.21 haveged 1.9.21-r0 —
Alpine v3.20 haveged 1.9.21-r0 —

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 haveged 1.9.22-1 —

Advisories 3

References