CVE-2026-41054 Details
Description
In `src/havegecmd.c`, the `socket_handler` function performs a credential check on the abstract UNIX socket (`\0/sys/entropy/haveged`). However, while it detects if the connecting user is not root (`cred.uid != 0`) and prepares a negative acknowledgement (`ASCII_NAK`), it **fails to stop execution**. The code proceeds to the `switch` statement, allowing any local unprivileged user to execute privileged commands such as `MAGIC_CHROOT`.
A privilege escalation vulnerability has been identified in haveged, the Linux entropy daemon, in all versions with command socket support (1.9.14 and later). The issue arises in the socket_handler function, which performs a credential check on the abstract UNIX socket for entropy commands. While the function correctly identifies non-root users and sends a negative acknowledgment, it fails to terminate the execution. This oversight allows unprivileged local users to execute privileged commands, such as MAGIC_CHROOT, by sending them through the socket to the root-running daemon.
Users can update to haveged version 1.9.21, which addresses this vulnerability by properly handling the UID check and preventing unauthorized command execution. Instructions for updating can be found in the SUSE Update Announcement.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-305 | Authentication Bypass by Primary Weakness | [email protected] |
Affected Products
No affected product data is available for this CVE.
Change History
8 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 24, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 5, 2026 | CVE Modified | CVE |
| May 22, 2026 | CVE Modified | CVE |
| May 21, 2026 | CVE Modified | CVE |
| May 20, 2026 | CVE Modified | CVE |
| May 20, 2026 | New CVE Received | [email protected] |