CVE-2026-58302 Details
Description
rtapi_app in linuxcnc-uspace in LinuxCNC before 2.9.9 allows privilege escalation. It is installed SUID root and loads shared library modules via dlopen() by using a user-supplied module name. Insufficient validation of the module name allows path traversal, enabling an unprivileged local user to load an arbitrary shared library. Because the process retains elevated privileges during module loading, this results in local privilege escalation to root.
A privilege escalation vulnerability has been identified in the RTAPI application of the LinuxCNC software, specifically in versions prior to 2.9.9. The issue arises because the RTAPI application is installed with SUID root permissions, allowing it to execute with elevated privileges. The vulnerability is created by insufficient validation of user-supplied module names when loading shared library modules via dlopen(). This lack of proper validation enables a local, unprivileged user to perform path traversal attacks, potentially leading to the loading of arbitrary shared libraries. Since the RTAPI application retains these elevated privileges while the malicious library is loaded, this flaw can be exploited to gain root access.
Users can upgrade to LinuxCNC version 2.9.9 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 30, 2026CISA-ADP
Assessed Jun 30, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://bugs.debian.org/1140943 | [email protected] | AdvisoryIssue TrackingRemedy |
| https://github.com/LinuxCNC/linuxcnc/commit/00d534c87464a3ed446656998aa02b8abc74b391 | [email protected] | Source CodeVendor |
| https://github.com/LinuxCNC/linuxcnc/commit/ea7cd579d39b586952a42e3da9a26d3e36e7a272 | [email protected] | Source CodeVendor |
| https://github.com/LinuxCNC/linuxcnc/compare/v2.9.8...v2.9.9 | [email protected] | Source CodeVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| LinuxCNC | >= 1:2.9.0, < 1:2.9.9-1 >= 1:2.9.4-2 >= 2.9.0~pre1+git20230208.f1270d6ed7-1 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 30, 2026 | CVE Modified | CISA-ADP |
| Jun 30, 2026 | New CVE Received | [email protected] |