CVE-2026-44028: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-44028 is a local privilege escalation vulnerability caused by unbounded recursion in the NAR (Nix Archive) parser of Nix and Lix, leading to a stack-to-heap overflow on coroutine stacks. It affects Nix versions ≥2.24.4 through 2.34.6 and Lix versions ≥2.93.0 through 2.95.1. The vulnerability was disclosed on May 4–5, 2026, via coordinated security advisories from the Nix and Lix projects. It carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, Nix Advisory).

The root cause is uncontrolled recursion (CWE-674) in the NAR directory parser, which can also result in an out-of-bounds write (CWE-787) when the parser is executed on a coroutine stack. Because coroutine stacks in affected versions are allocated without a guard page, a stack overflow can silently overwrite adjacent heap memory rather than triggering a segmentation fault. An attacker with local access to the Nix daemon socket can submit a specially crafted NAR archive with deeply nested directory structures to trigger the unbounded recursion, potentially overwriting heap data to achieve arbitrary code execution — provided ASLR hardening is bypassed. The vulnerability was introduced in Nix 2.24.4 via PR #11152 and backported to 2.24 via PR #11360 (Nix Advisory, oss-security).

Successful exploitation allows a local attacker to execute arbitrary code as the Nix daemon user, which runs as root in multi-user installations, resulting in full system compromise with high confidentiality and integrity impact. An attacker gaining root-level code execution could access all data on the system, modify system files, install persistent backdoors, and pivot to other systems on the network. Availability is not directly impacted by the overflow itself, though a failed exploitation attempt could crash the daemon worker process (Nix Advisory, oss-security).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation as of the time of disclosure (GitHub Advisory). Exploitation requires a local user account with permission to connect to the Nix daemon (governed by the allowed-users setting, which defaults to all users), and additionally requires bypassing ASLR — raising the practical attack complexity. The EPSS score is approximately 0.006% (0th percentile), reflecting low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The oss-security disclosure notes that substituters could theoretically trigger the issue but cannot make enough attempts to mount practical attacks (oss-security).

1. Reconnaissance: Identify a target system running a vulnerable multi-user Nix or Lix installation (Nix ≥2.24.4 and <patched version, or Lix ≥2.93.0 and <patched version) where the attacker has a local user account permitted to connect to the Nix daemon socket (default: all users).
2. Craft malicious NAR archive: Construct a NAR (Nix Archive) file containing deeply nested directory entries designed to trigger unbounded recursion in the NAR directory parser when processed by the daemon.
3. Submit archive to daemon: Connect to the Nix daemon socket (typically /nix/var/nix/daemon-socket/socket) and submit the crafted NAR archive as part of a legitimate daemon operation (e.g., a store path addition or substitution request).
4. Trigger stack-to-heap overflow: The unbounded recursion exhausts the coroutine stack (which lacks a guard page), causing the stack to overflow into adjacent heap memory, overwriting heap data structures.
5. Bypass ASLR: Use ASLR weakening techniques (e.g., heap spraying, information leaks, or repeated crash-and-retry — the daemon limits worker crashes to 64 in patched versions) to gain predictable control over overwritten heap memory.
6. Achieve arbitrary code execution: Manipulate overwritten heap data to redirect execution flow, ultimately executing attacker-controlled code as the Nix daemon (root), enabling full system compromise (Nix Advisory, oss-security).

• Logs: Repeated Nix daemon worker process crashes (crash logs or journal entries for nix-daemon) in a short time window, potentially indicating ASLR bypass attempts via crash-and-retry.
• Process: Unexpected child processes spawned by nix-daemon running as root (e.g., shells, network tools like curl, wget, or nc).
• Network: Outbound connections from the system initiated by the nix-daemon process to unexpected external hosts, which may indicate post-exploitation activity.
• File System: New or modified files in privileged directories (e.g., /etc/, /root/, /nix/store/) created or modified by the nix-daemon process outside of normal package management operations; unexpected cron jobs or systemd units added after daemon activity.
• Logs: Nix daemon logs showing an unusually high volume of NAR parsing operations or repeated failed operations from a single local user account (Nix Advisory, oss-security).

Upgrade to a patched version immediately: for Nix, the fixed versions are 2.34.7, 2.33.6, 2.32.8, 2.31.5, 2.30.5, 2.29.4, and 2.28.7; for Lix, the fixed versions are 2.95.2, 2.94.2, and 2.93.4 (Nix Advisory). As a workaround prior to patching, restrict access to the Nix daemon by configuring the allowed-users and trusted-users settings in nix.conf to limit which local users can connect to the daemon. Ensure ASLR is enabled on the host system (/proc/sys/kernel/randomize_va_space set to 2) to increase the difficulty of exploitation. The patched versions also introduce NAR directory recursion depth limits (64 levels), guard pages on coroutine stacks, bounded archive entry metadata lengths, and a cap of 64 forked worker crashes to mitigate ASLR bypass attempts (oss-security).

The vulnerability was disclosed via a coordinated advisory between the Nix and Lix projects, with the NixOS security team (hexa and tgerbet) coordinating the disclosure and researchers edef and sandydoo credited with discovery (oss-security). The Lix project published an in-depth blog post on May 5, 2026, covering the technical details of their variant of the vulnerability (Lix Blog). The disclosure was discussed on the Lobsters community aggregator and noted in the NixOS Discourse forum, reflecting community awareness within the Nix ecosystem. openSUSE also issued a security announcement addressing the vulnerability for their packages (openSUSE).