High
linuxcnc — security advisory
rtapi_app in linuxcnc-uspace in LinuxCNC before 2.9.9 allows privilege escalation. It is installed SUID root and loads shared library modules via dlopen() by using a user-supplied module name. Insufficient validation of the module name allows path traversal, enabling an unprivileged local user to load an arbitrary shared library. Because the process retains elevated privileges during module loading, this results in local privilege escalation to root.
- Products
- linuxcnc
- Affected versions
- 1:2.9.4-2ubuntu1, 1:2.9.4-2ubuntu2, 1:2.9.4-2ubuntu3, 1:2.9.4-2ubuntu4
- Fixed versions
- Not specified
- CVEs
- CVE-2026-58302
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 02:48 UTC · Revision 1
Source evidence
rtapi_app in linuxcnc-uspace in LinuxCNC before 2.9.9 allows privilege escalation. It is installed SUID root and loads shared library modules via dlopen() by using a user-supplied module name. Insufficient validation of the module name allows path traversal, enabling an unprivileged local user to load an arbitrary shared library. Because the process retains elevated privileges during module loading, this results in local privilege escalation to root.
osv:UBUNTU-CVE-2026-58302
linuxcnc
Fixed versions: Not specified
linuxcnc
Fixed versions: Not specified
linuxcnc
Fixed versions: Not specified
Complete source record
{
"id": "174ebaf7a7c64c2a9daec73e295a14f2c5a1d02ff9a60463e27e868562064bd1",
"url": "https://osv.dev/vulnerability/UBUNTU-CVE-2026-58302",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "UBUNTU-CVE-2026-58302",
"summary": "rtapi_app in linuxcnc-uspace in LinuxCNC before 2.9.9 allows privilege escalation. It is installed SUID root and loads shared library modules via dlopen() by using a user-supplied module name. Insufficient validation of the module name allows path traversal, enabling an unprivileged local user to load an arbitrary shared library. Because the process retains elevated privileges during module loading, this results in local privilege escalation to root.",
"evidence": "osv:UBUNTU-CVE-2026-58302",
"products": [
{
"name": {
"value": "linuxcnc",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1:2.9.4-2ubuntu1",
"evidence": "/affected/0/versions"
},
{
"value": "1:2.9.4-2ubuntu2",
"evidence": "/affected/0/versions"
}
]
},
{
"name": {
"value": "linuxcnc",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1:2.9.4-2ubuntu4",
"evidence": "/affected/1/versions"
}
]
},
{
"name": {
"value": "linuxcnc",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1:2.9.4-2ubuntu2",
"evidence": "/affected/2/versions"
},
{
"value": "1:2.9.4-2ubuntu3",
"evidence": "/affected/2/versions"
},
{
"value": "1:2.9.4-2ubuntu4",
"evidence": "/affected/2/versions"
}
]
}
],
"severity": "high",
"structured": {
"id": "UBUNTU-CVE-2026-58302",
"aliases": [
"UBUNTU-CVE-2026-58302"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
},
{
"type": "Ubuntu",
"score": "medium"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "linuxcnc",
"purl": "pkg:deb/ubuntu/linuxcnc?arch=source&distro=questing",
"ecosystem": "Ubuntu:25.10"
},
"versions": [
"1:2.9.4-2ubuntu1",
"1:2.9.4-2ubuntu2"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-58302.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "linuxcnc-doc-de",
"binary_version": "1:2.9.4-2ubuntu2"
},
{
"binary_name": "linuxcnc-doc-en",
"binary_version": "1:2.9.4-2ubuntu2"
},
{
"binary_name": "linuxcnc-doc-es",
"binary_version": "1:2.9.4-2ubuntu2"
},
{
"binary_name": "linuxcnc-doc-fr",
"binary_version": "1:2.9.4-2ubuntu2"
},
{
"binary_name": "linuxcnc-doc-zh-cn",
"binary_version": "1:2.9.4-2ubuntu2"
},
{
"binary_name": "linuxcnc-uspace",
"binary_version": "1:2.9.4-2ubuntu2"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "linuxcnc",
"purl": "pkg:deb/ubuntu/linuxcnc?arch=source&distro=stonking",
"ecosystem": "Ubuntu:26.10"
},
"versions": [
"1:2.9.4-2ubuntu4"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-58302.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "linuxcnc-doc-de",
"binary_version": "1:2.9.4-2ubuntu4"
},
{
"binary_name": "linuxcnc-doc-en",
"binary_version": "1:2.9.4-2ubuntu4"
},
{
"binary_name": "linuxcnc-doc-es",
"binary_version": "1:2.9.4-2ubuntu4"
},
{
"binary_name": "linuxcnc-doc-fr",
"binary_version": "1:2.9.4-2ubuntu4"
},
{
"binary_name": "linuxcnc-doc-zh-cn",
"binary_version": "1:2.9.4-2ubuntu4"
},
{
"binary_name": "linuxcnc-uspace",
"binary_version": "1:2.9.4-2ubuntu4"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "linuxcnc",
"purl": "pkg:deb/ubuntu/linuxcnc?arch=source&distro=resolute",
"ecosystem": "Ubuntu:26.04:LTS"
},
"versions": [
"1:2.9.4-2ubuntu2",
"1:2.9.4-2ubuntu3",
"1:2.9.4-2ubuntu4"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-58302.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "linuxcnc-doc-de",
"binary_version": "1:2.9.4-2ubuntu4"
},
{
"binary_name": "linuxcnc-doc-en",
"binary_version": "1:2.9.4-2ubuntu4"
},
{
"binary_name": "linuxcnc-doc-es",
"binary_version": "1:2.9.4-2ubuntu4"
},
{
"binary_name": "linuxcnc-doc-fr",
"binary_version": "1:2.9.4-2ubuntu4"
},
{
"binary_name": "linuxcnc-doc-zh-cn",
"binary_version": "1:2.9.4-2ubuntu4"
},
{
"binary_name": "linuxcnc-uspace",
"binary_version": "1:2.9.4-2ubuntu4"
}
]
}
}
],
"modified": "2026-10-17T12:59:13.517751273Z",
"provider": "osv",
"upstream": [
"CVE-2026-58302"
],
"references": [
"https://ubuntu.com/security/CVE-2026-58302",
"https://www.cve.org/CVERecord?id=CVE-2026-58302",
"https://github.com/LinuxCNC/linuxcnc/commit/00d534c87464a3ed446656998aa02b8abc74b391",
"https://bugs.debian.org/1140943",
"https://github.com/LinuxCNC/linuxcnc/commit/ea7cd579d39b586952a42e3da9a26d3e36e7a272",
"https://github.com/LinuxCNC/linuxcnc/compare/v2.9.8...v2.9.9"
]
},
"related_cves": [
{
"value": "CVE-2026-58302",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 359474,
"published_at": "2026-06-30T02:16:00+00:00"
}