CVE-2026-4878

Name	CVE-2026-4878
Description	A flaw was found in libcap. A local unprivileged user can exploit a Time-of-check-to-time-of-use (TOCTOU) race condition in the `cap_set_file()` function. This allows an attacker with write access to a parent directory to redirect file capability updates to an attacker-controlled file. By doing so, capabilities can be injected into or stripped from unintended executables, leading to privilege escalation.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
libcap2 (PTS)	bullseye	1:2.44-1	vulnerable
	bullseye (security)	1:2.44-1+deb11u1	vulnerable
	bookworm	1:2.66-4+deb12u2	vulnerable
	trixie	1:2.75-10	vulnerable
	forky, sid	1:2.78-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
libcap2	source	(unstable)	1:2.78-1

Notes

[trixie] - libcap2 <no-dsa> (Minor issue)
[bookworm] - libcap2 <no-dsa> (Minor issue)
https://github.com/AndrewGMorgan/libcap_mirror/security/advisories/GHSA-f78v-p5hx-m7hh
https://sites.google.com/site/fullycapable/release-notes-for-libcap#h.x4zn8j3lss6r
Fixed by: https://git.kernel.org/pub/scm/libs/libcap/libcap.git/commit/?id=286ace1259992bd0c5d9016715833f2e148ac596 (libcap-2.78)