TLDR Index

TLDR InfoSec · QUICK LINKS

GLIBC LD.SO TOCTOU LETS LOCAL USERS HIJACK $ORIGIN ON SETUID BINARIES

freenode.net1 min read

Summary from the TLDR InfoSec newsletter

A race in glibc's ld.so (CVE-2026-86805, versions 2.14 through 2.44) lets local users hardlink a setuid binary whose $ORIGIN RPATH uses ".." traversal and swap in a symlink to load attacker code with elevated privileges.

Read the original article ↗View the archived TLDR InfoSec issue