CVE-2026-4878: 
Bottlerocket vulnerability analysis and mitigation

CVE-2026-4878 is a Time-of-check-to-time-of-use (TOCTOU) race condition vulnerability in the cap_set_file() function of libcap that allows a local unprivileged user to escalate privileges by redirecting file capability updates to an attacker-controlled file. The flaw affects libcap (all versions prior to the patched releases), and downstream distributions including Red Hat Enterprise Linux 8/9/10, Red Hat OpenShift Container Platform 4.x, IBM MQ Operator container images, IBM App Connect Enterprise Certified Container, and Microsoft Azure Linux (AZL3/CBL2) packages. It was reported on March 26, 2026, publicly disclosed via the oss-security mailing list on April 9, 2026, and patches began shipping from April 10, 2026 onward. The CVSS v3.1 base score is 7.0 (High) per NVD (Red Hat Bugzilla, Microsoft MSRC, Red Hat Advisory).

The root cause is a TOCTOU race condition (CWE-367) in libcap's cap_set_file() function. The function first validates the target path using lstat() — which does not follow symbolic links — to confirm the target is a regular, non-symlink file. It then applies or removes the security.capability extended attribute via setxattr() / removexattr(), which re-resolve the path and do follow symlinks. An attacker with write access to the parent directory of the target file can exploit the window between these two calls by atomically swapping the validated regular file with a symlink or alternate file using the renameat2(RENAME_EXCHANGE) syscall. A self-contained C proof-of-concept that deterministically reproduces this race condition was published on the oss-security mailing list, demonstrating how capabilities such as CAP_SETUID can be injected into an attacker-controlled binary to achieve root escalation (Red Hat Bugzilla, oss-security PoC).

Successful exploitation allows a local unprivileged user to inject arbitrary Linux capabilities (e.g., CAP_SETUID, CAP_NET_ADMIN) into an attacker-controlled executable, or strip capabilities from legitimate binaries, enabling full privilege escalation to root. The attack is particularly dangerous in environments where privileged processes such as setcap, package installation scripts, or container tooling invoke cap_set_file() on paths accessible or influenceable by unprivileged users. Affected asset scope includes any Linux system running a vulnerable version of libcap, including containerized workloads on Red Hat OpenShift and IBM container platforms (Red Hat Bugzilla, IBM Advisory).

A high-confidence proof-of-concept C program that deterministically reproduces the vulnerability using renameat2(RENAME_EXCHANGE) is publicly available on the oss-security mailing list (oss-security PoC). Exploitation requires local access and write permissions to a parent directory of a target file, and the attack complexity is rated High due to the race condition timing requirement. There is no evidence of in-the-wild exploitation at this time, and the CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.011% (0.000110), indicating low current exploitation probability (Feedly).

1. Reconnaissance: Identify a target system running a vulnerable version of libcap where a privileged process (e.g., setcap, a package manager post-install script, or container tooling) calls cap_set_file() on a path within a directory the attacker has write access to.
2. Setup attacker-controlled files: In the writable parent directory, create two files: a legitimate regular file (e.g., legit_file) that will pass lstat() validation, and an attacker-controlled executable (e.g., evil_binary) that should receive the injected capability.
3. Create symlink: Create a symbolic link (e.g., evil_link) pointing to a high-value target binary or the attacker's own binary.
4. Trigger the privileged operation: Cause or wait for the privileged process to invoke cap_set_file() targeting legit_file (e.g., by triggering a package reinstall or calling setcap on the file).
5. Race the window: In a tight loop, use renameat2(RENAME_EXCHANGE) to atomically swap legit_file with evil_link between the lstat() check and the setxattr() call in cap_set_file(). The PoC uses a dedicated thread or process to maximize the probability of winning the race.
6. Capability injection: When the swap succeeds during the race window, setxattr() applies the capability (e.g., CAP_SETUID) to the symlink target — the attacker's binary — instead of the intended file.
7. Privilege escalation: Execute the now-capability-endowed binary to escalate to root or gain other elevated privileges (oss-security PoC, Red Hat Bugzilla).

• File System: Unexpected security.capability extended attributes on executables not normally granted capabilities (check with getcap -r / or getfattr -n security.capability <file>); presence of unfamiliar SUID/capability-enabled binaries in user-writable directories.
• Process: Unusual invocations of renameat2 syscall with RENAME_EXCHANGE flag in rapid succession from unprivileged user processes (detectable via auditd syscall auditing); unexpected child processes of setcap or package manager scripts spawning shells or network tools.
• Logs: auditd records showing setxattr calls on files in user-writable directories by privileged processes; repeated lstat/setxattr sequences on the same path in rapid succession in strace or audit logs.
• Network: Outbound connections from newly privileged processes that previously had no network access (may indicate post-exploitation lateral movement).

Apply vendor-supplied patches immediately. Red Hat has released fixes across multiple errata: RHSA-2026:12423 (RHEL 10), RHSA-2026:12441 (RHEL 9), RHSA-2026:13285 (RHEL 8), and numerous Extended Update Support and OpenShift advisories (RHSA-2026:23245 for OCP 4.19). The patched libcap version in Red Hat Hardened Images is libcap-2.78-1.1.hum1. Microsoft has released fixes for AZL3 (libcap-2.69-14) and CBL2 (libcap-2.60-7). IBM has addressed the issue in MQ Operator container images and App Connect Enterprise Certified Container. As a workaround until patching is possible, restrict write permissions on parent directories of sensitive executables, limit which users can invoke setcap or tools that call cap_set_file(), and monitor file capability changes on critical binaries (Red Hat Advisory, Red Hat Bugzilla, Microsoft MSRC, IBM Advisory).

The vulnerability was disclosed via the oss-security mailing list on April 9, 2026, with a detailed technical analysis and a working PoC, prompting rapid patch releases from Red Hat, Microsoft, and IBM within days to weeks of disclosure (oss-security PoC, oss-security Discussion). The openSUSE and Debian communities also issued security advisories and updated packages shortly after. A blog post titled "From Zero to Privileged: Understanding CVE-2026-4878" was published in May 2026, indicating community interest in the exploitation mechanics. The vulnerability received broad coverage across Linux security news outlets and distribution security announcement lists.