In `src/havegecmd.c`, the `socket_handler` function performs a credential check on the abstract UNIX socket (`\0/sys/entropy/haveged`). However, while it detects if the connecting user is not root (`cred.uid != 0`) and prepares a negative acknowledgement (`ASCII_NAK`), it **fails to stop execution**. The code proceeds to the `switch` statement, allowing any local unprivileged user to execute privileged commands such as `MAGIC_CHROOT`.

The remote Ubuntu 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-8358-1 advisory.

    It was discovered that haveged incorrectly handled credential checks on its control socket. A local     attacker could possibly use this issue to execute privileged commands.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-02b08daa05 advisory.

    Update to 1.9.22  fix systemd sandboxing: add `ReadWritePaths=/dev/shm` for semaphore creation

    Backport fix for CVE-2026-41054: privilege escalation via command socket

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by a vulnerability as referenced in the dla-4616 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-4616-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                    Thorsten Alteholz     June 05, 2026                                 https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : haveged     Version        : 1.9.14-1+deb11u1     CVE ID         : CVE-2026-41054


    Dirk Mueller discovered that a flaw in the function performing a     credential check on the command socket of haveged, a userspace entropy     daemon, may result in local privilege escalation.


    For Debian 11 bullseye, this problem has been fixed in version     1.9.14-1+deb11u1.

    We recommend that you upgrade your haveged packages.

    For the detailed security status of haveged please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/haveged

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-5d9b0e2c17 advisory.

    Update to 1.9.22  fix systemd sandboxing: add ReadWritePaths=/dev/shm for semaphore creation

    ----

    Backport fix for CVE-2026-41054: privilege escalation via command socket

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-12643837bd advisory.

    Backport fix for CVE-2026-41054: privilege escalation via command socket

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 12 / 13 host has packages installed that are affected by a vulnerability as referenced in the dsa-6292 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6292-1                   security@debian.org     https://www.debian.org/security/                     Salvatore Bonaccorso     May 22, 2026                          https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : haveged     CVE ID         : CVE-2026-41054     Debian Bug     : 1137096

    Dirk Mueller discovered that a flaw in the function performing a     credential check on the command socket of haveged, a userspace entropy     daemon, may result in local privilege escalation.

    For the oldstable distribution (bookworm), this problem has been fixed     in version 1.9.14-1+deb12u1.

    For the stable distribution (trixie), this problem has been fixed in     version 1.9.19-12+deb13u1.

    We recommend that you upgrade your haveged packages.

    For the detailed security status of haveged please refer to its security     tracker page at:
    https://security-tracker.debian.org/tracker/haveged

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - In `src/havegecmd.c`, the `socket_handler` function performs a credential check on the abstract UNIX
    socket (`\0/sys/entropy/haveged`). However, while it detects if the connecting user is not root (`cred.uid
    != 0`) and prepares a negative acknowledgement (`ASCII_NAK`), it **fails to stop execution**. The code
    proceeds to the `switch` statement, allowing any local unprivileged user to execute privileged commands
    such as `MAGIC_CHROOT`. (CVE-2026-41054)

The version of haveged installed on the remote host is prior to 1.9.21. It is, therefore, affected by a vulnerability as referenced in the SSA:2026-139-01 advisory.

    New haveged packages are available for Slackware 15.0 and -current to fix a security issue.

Tenable has extracted the preceding description block directly from the haveged security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
320479	Ubuntu 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS : haveged vulnerability (USN-8358-1)	Nessus	Ubuntu Local Security Checks	high
319654	Fedora 44 : haveged (2026-02b08daa05)	Nessus	Fedora Local Security Checks	high
318795	Debian dla-4616 : haveged - security update	Nessus	Debian Local Security Checks	high
318011	Fedora 43 : haveged (2026-5d9b0e2c17)	Nessus	Fedora Local Security Checks	high
317515	Fedora 44 : haveged (2026-12643837bd)	Nessus	Fedora Local Security Checks	high
316543	Debian dsa-6292 : haveged - security update	Nessus	Debian Local Security Checks	high
442234	Alpine: multiple haveged packages: security update to 1.9.21-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	high
442234	Alpine: multiple haveged packages: security update to 1.9.21-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
315521	Slackware Linux 15.0 / current haveged Vulnerability (SSA:2026-139-01)	Nessus	Slackware Local Security Checks	high

Detections

Analytics

CVE-2026-41054

high

Tenable Plugins

high

high

high

high

high

high

high

high

high