Description
A time-of-check to time-of-use (TOCTOU) race condition in the dynamic loader (ld.so) of the GNU C Library (glibc) versions 2.14 through 2.44 allows a local attacker to escalate privileges. When expanding $ORIGIN in DT_RPATH for setuid/setgid (AT_SECURE) programs, glibc validates the lexically normalized search path against the trusted directories but then opens the raw, un-normalized path. On systems where the Linux fs.protected_hardlinks sysctl is disabled, a local attacker who hard-links such a program into an attacker-controlled directory and wins a race to replace an intermediate path component with a symbolic link can direct the loader outside the trusted directory, causing it to load an attacker-controlled shared object and execute arbitrary code with the elevated privileges of the program.
Exploitation requires an installed setuid or setgid binary whose DT_RPATH uses $ORIGIN followed by ".." traversal that normalizes into a trusted directory, and the ability to hard-link that binary and win the race by swapping a path component for a symbolic link. Major Linux-based OS distributions ship with fs.protected_hardlinks enabled by default and mitigate the vulnerability.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| The GNU C Library | glibc | 2.14 – < 2.45 | 2.45 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | glibc | 2.43-7 | — |
| Debian 13 | glibc | No fix yet | — |
| Debian 12 | glibc | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | glibc | 2.44-1ubuntu2.1 | USN-9065-1 |
| Ubuntu 26.04 LTS | glibc | 2.43-2ubuntu2.7 | USN-9065-1 |
| Ubuntu 24.04 LTS | glibc | 2.39-0ubuntu8.12 | USN-9065-1 |
| Ubuntu 22.04 LTS | glibc | 2.35-0ubuntu3.18 | USN-9065-1 |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 20.04 LTS | glibc | No fix yet | — |
| Ubuntu Pro 18.04 LTS | glibc | No fix yet | — |
| Ubuntu Pro 16.04 LTS | glibc | No fix yet | — |
| Ubuntu Pro 14.04 LTS | eglibc | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | glibc +220 | 2.39-147.el10_3 | RHSA-2026:98599 |
| RHEL 9 | nscd +214 | 2.34-284.el9_8.4 | RHSA-2026:98512, RHSA-2026:95618 |
| RHEL 8 | nscd +213 | 2.28-251.el8_10.53 | RHSA-2026:96087 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Hardened Images 1 | glibc +227 | 2.43-8.7.hum1 | RHSA-2026:72503 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 9 | nscd +172 | 2.34-284.el9_8.4 | ALSA-2026:95618 |
| AlmaLinux 8 | nscd +213 | 2.28-251.el8_10.53 | ALSA-2026:96087 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | glibc +219 | 2.39-147.el10_3 | RLSA-2026:98599 |
| Rocky Linux 9 | glibc | 2.34-284.el9_8.4 | RLSA-2026:98512, RLSA-2026:95618 |
| Rocky Linux 9 | nscd +211 | 2.34-290.el9_9 | RLSA-2026:98512 |
| Rocky Linux 8 | glibc | 2.28-251.el8_10.53 | RLSA-2026:96087 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | glibc | 2.38-150600.14.61.1 | SUSE-SU-2026:4656-1 |
| SLES 15 SP6 | glibc | 2.38-150600.14.61.1 | SUSE-SU-2026:4656-1 |
| SLES 15 SP5 | glibc | 2.31-150300.109.1 | SUSE-SU-2026:4591-1 |
| SLES 15 SP4 | glibc | 2.31-150300.109.1 | SUSE-SU-2026:4591-1 |
| SLES 12 SP5 | glibc | 2.22-114.55.1 | SUSE-SU-2026:4654-1 |
Show 14 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 11 SP4 | glibc | 2.11.3-17.110.58.1 | SUSE-SU-2026:4669-1 |
| SLES for SAP 16.0 | glibc | 2.40-160000.7.1 | SUSE-SU-2026:23934-1 |
| SLES for SAP 15 SP6 | glibc | 2.38-150600.14.61.1 | SUSE-SU-2026:4656-1 |
| SLES for SAP 15 SP5 | glibc | 2.31-150300.109.1 | SUSE-SU-2026:4591-1 |
| SLES for SAP 15 SP4 | glibc | 2.31-150300.109.1 | SUSE-SU-2026:4591-1 |
| SLES 16.0 | glibc | 2.40-160000.7.1 | SUSE-SU-2026:23934-1 |
| SLE Micro 6.2 | glibc | 2.40-160000.7.1 | SUSE-SU-2026:23957-1, SUSE-SU-2026:23929-1 |
| SLE Micro 6.1 | glibc | 2.38-slfo.1.1_11.1 | SUSE-SU-2026:24281-1 |
| SLE Micro 6.0 | glibc | 2.38-159998.1.1 | SUSE-SU-2026:24326-1 |
| SLE Micro 5.5 | glibc | 2.31-150300.109.1 | SUSE-SU-2026:4591-1 |
| SLE Micro 5.4 | glibc | 2.31-150300.109.1 | SUSE-SU-2026:4591-1 |
| SLE Micro 5.3 | glibc | 2.31-150300.109.1 | SUSE-SU-2026:4591-1 |
| SLE HPC 15 SP5 | glibc | 2.31-150300.109.1 | SUSE-SU-2026:4591-1 |
| SLE HPC 15 SP4 | glibc | 2.31-150300.109.1 | SUSE-SU-2026:4591-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | glibc | 2.44-3.1 | openSUSE-SU-2026:12072-1 |
| openSUSE Leap 16.0 | glibc +4 | 2.40-160000.7.1 | openSUSE-SU-2026:21968-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | nscd +217 | 2.34-231.amzn2023.0.6 | ALAS2023-2026-3396 |
| Amazon Linux 2 | nscd +199 | 2.26-64.amzn2.0.7 | ALAS2-2026-4078 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | glibc | No fix yet | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 9 | nscd +214 | 2.34-284.0.1.el9_8.4 | ELSA-2026-95618 |
| Oracle Linux 8 | nscd +213 | 2.28-251.0.5.el8_10.53 | ELSA-2026-96087 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | sln-2.43 +26 | 2.43-r18 | — |
| Wolfi rolling | sln-2.44 +26 | 2.44-r8 | — |
Advisories 28
- RHSA-2026:98599 Red Hat Security Advisory: glibc security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:98512 Red Hat Security Advisory: glibc security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:96087 Red Hat Security Advisory: glibc security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:95618 Red Hat Security Advisory: glibc security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RLSA-2026:98599 Moderate: glibc security update Rocky Linux Security Advisories · Nov 13, 2026
- RLSA-2026:98512 Moderate: glibc security, bug fix, and enhancement update Rocky Linux Security Advisories · Nov 13, 2026
- USN-9065-1 glibc vulnerabilities Ubuntu Security Notices (USN) · Nov 13, 2026
- WID-SEC-2026-3522 GNU libc: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 12, 2026
- RLSA-2026:96087 Moderate: glibc security update Rocky Linux Security Advisories · Nov 10, 2026
- ALSA-2026:96087 Moderate: glibc security update AlmaLinux Security Advisories · Nov 10, 2026
- ALAS2023-2026-3396 Important: glibc security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Nov 9, 2026
- ALAS2-2026-4078 Important: glibc security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Nov 9, 2026
- ELSA-2026-96087 Moderate: glibc security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Nov 9, 2026
- RLSA-2026:95618 Moderate: glibc security update Rocky Linux Security Advisories · Nov 6, 2026
- ALSA-2026:95618 Moderate: glibc security update AlmaLinux Security Advisories · Nov 6, 2026
- ELSA-2026-95618 Moderate: glibc security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Nov 6, 2026
- SUSE-SU-2026:24326-1 Security update for glibc SUSE / openSUSE Security Updates · Oct 27, 2026
- SUSE-SU-2026:24281-1 Security update for glibc SUSE / openSUSE Security Updates · Oct 27, 2026
- SUSE-SU-2026:4669-1 Security update for glibc SUSE / openSUSE Security Updates · Oct 15, 2026
- SUSE-SU-2026:4656-1 Security update for glibc SUSE / openSUSE Security Updates · Oct 14, 2026
- SUSE-SU-2026:4654-1 Security update for glibc SUSE / openSUSE Security Updates · Oct 14, 2026
- SUSE-SU-2026:4591-1 Security update for glibc SUSE / openSUSE Security Updates · Oct 9, 2026
- openSUSE-SU-2026:12072-1 glibc-2.44-3.1 on GA media SUSE / openSUSE Security Updates · Oct 9, 2026
- SUSE-SU-2026:23957-1 Security update for glibc SUSE / openSUSE Security Updates · Oct 2, 2026
- SUSE-SU-2026:23929-1 Security update for glibc SUSE / openSUSE Security Updates · Oct 2, 2026
- SUSE-SU-2026:23934-1 Security update for glibc SUSE / openSUSE Security Updates · Oct 2, 2026
- openSUSE-SU-2026:21968-1 Security update for glibc SUSE / openSUSE Security Updates · Oct 1, 2026
- RHSA-2026:72503 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Sep 29, 2026