CVE-2026-58302

rtapi_app in linuxcnc-uspace in LinuxCNC before 2.9.9 allows privilege escalation. It is installed SUID root and loads shared library modules via dlopen() by using a user-supplied module name. Insufficient validation of the module name allows path traversal, enabling an unprivileged local user to load an arbitrary shared library. Because the process retains elevated privileges during module loading, this results in local privilege escalation to root.

• CWE-22

• https://bugs.debian.org/1140943
• https://github.com/LinuxCNC/linuxcnc/commit/00d534c87464a3ed446656998aa02b8abc74b391
• https://github.com/LinuxCNC/linuxcnc/commit/ea7cd579d39b586952a42e3da9a26d3e36e7a272
• https://github.com/LinuxCNC/linuxcnc/compare/v2.9.8...v2.9.9

Published

Jun 30, 2026

Last Modified

Jun 30, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-58296Exposure of private personal information to an unauthorized …7.1
• CVE-2026-58297Exposure of private personal information to an unauthorized …7.1
• CVE-2026-58298Improper neutralization of input during web page generation …6.1
• CVE-2026-58299Time-of-check time-of-use (toctou) race condition in Microso…7.5
• CVE-2026-5830A vulnerability was identified in Tenda AC15 15.03.05.18. Th…8.8
• CVE-2026-58300Absolute path traversal in Microsoft Edge for Android allows…6.2
• CVE-2026-58303Stack-based buffer overflow vulnerability in Samsung Open So…6.1
• CVE-2026-58304Out-of-bounds read, Out-of-bounds write vulnerability in Sam…6.1
• CVE-2026-58305Access of resource using incompatible type ('type confusion'…6.1
• CVE-2026-58306Heap-based buffer overflow vulnerability in Samsung Open Sou…6.1
• CVE-2026-58307Out-of-bounds read, Reachable assertion vulnerability in Sam…6.1
• CVE-2026-5831A security flaw has been discovered in Agions taskflow-ai up…6.3