glibc ld.so TOCTOU lets local users hijack $ORIGIN on setuid binaries

The GNU C Library has published an advisory for CVE-2026-86805, a local privilege-escalation flaw in the dynamic loader that can cause setuid and setgid programs to load attacker-controlled shared objects.

In glibc versions 2.14 through 2.44, when expanding $ORIGIN in DT_RPATH for AT_SECURE binaries, ld.so checks a lexically normalized search path against trusted directories, then opens the raw, un-normalized path. On systems where the Linux fs.protected_hardlinks sysctl is disabled, a local attacker who hard-links such a binary into a directory they control and wins a race to replace an intermediate path component with a symbolic link can steer the loader outside the trusted tree and run arbitrary code with the program's elevated privileges.

Exploitation needs an installed setuid or setgid binary whose DT_RPATH uses $ORIGIN with ".." traversal that normalizes into a trusted directory, plus the ability to hard-link that binary and win the race. Major Linux distributions ship with protected hardlinks enabled by default and thereby mitigate the issue. The fix landed in glibc 2.45. Jann Horn reported the bug.