A time-of-check to time-of-use (TOCTOU) race condition in the dynamic loader (ld.so) of the GNU C Library (glibc) versions 2.14 through 2.44 allows a local attacker to escalate privileges. When expanding $ORIGIN in DT_RPATH for setuid/setgid (AT_SECURE) programs, glibc validates the lexically normalized search path against the trusted directories but then opens the raw, un-normalized path. On systems where the Linux fs.protected_hardlinks sysctl is disabled, a local attacker who hard-links such a program into an attacker-controlled directory and wins a race to replace an intermediate path component with a symbolic link can direct the loader outside the trusted directory, causing it to load an attacker-controlled shared object and execute arbitrary code with the elevated privileges of the program. Exploitation requires an installed setuid or setgid binary whose DT_RPATH uses $ORIGIN followed by ".." traversal that normalizes into a trusted directory, and the ability to hard-link that binary and win the race by swapping a path component for a symbolic link. Major Linux-based OS distributions ship with fs.protected_hardlinks enabled by default and mitigate the vulnerability.

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1793733350 advisory.

  - A time-of-check to time-of-use (TOCTOU) race condition in the dynamic loader (ld.so) of the GNU C Library     (glibc) versions 2.14 through 2.44 allows a local attacker to escalate privileges. When expanding $ORIGIN     in DT_RPATH for setuid/setgid (AT_SECURE) programs, glibc validates the lexically normalized search path     against the trusted directories but then opens the raw, un-normalized path. On systems where the Linux     fs.protected_hardlinks sysctl is disabled, a local attacker who hard-links such a program into an     attacker-controlled directory and wins a race to replace an intermediate path component with a symbolic     link can direct the loader outside the trusted directory, causing it to load an attacker-controlled shared     object and execute arbitrary code with the elevated privileges of the program. Exploitation requires an     installed setuid or setgid binary whose DT_RPATH uses $ORIGIN followed by .. traversal that normalizes     into a trusted directory, and the ability to hard-link that binary and win the race by swapping a path     component for a symbolic link. Major Linux-based OS distributions ship with fs.protected_hardlinks enabled     by default and mitigate the vulnerability. (CVE-2026-86805)

  - A stack-based buffer overflow in the dynamic loader (ld.so) of the GNU C Library (glibc) versions 2.14     through 2.44 allows a local attacker to crash or corrupt the memory of setuid/setgid (AT_SECURE) programs.
    When such a program's DT_RPATH or DT_RUNPATH begins with $ORIGIN and is followed by NUL or '/' the loader     both reads past the end of the path buffer and writes past the end of a stack-allocated internal buffer.
    The corrupted loader stack can lead to a loader crash (denial of service) and limited disclosure of     process memory. (CVE-2026-95818)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4591-1 advisory.

    - CVE-2026-6368: wordexp WRDE_APPEND rollback restores stale we_wordv, leading to invalid free in wordfree       (bsc#1274726).
    - CVE-2026-6791: wordexp: unbounded alloca (strndupa) in parse_tilde (bsc#1274723).
    - CVE-2026-8674: reachable assert in `resolv/resolv_conf.c:update_from_conf` allows an attacker in a local     network to       trigger a process crash (bsc#1281297).
    - CVE-2026-18374: overflow in the fopen ccs extension (bsc#1277262).
    - CVE-2026-19542: Fix out-of-bounds array write in tdelete (bsc#1276946).
    - CVE-2026-77117: non-progress DoS in SHIFT_JISX0213 -> UCS-4 conversion state handling (bsc#1277921).
    - CVE-2026-80489: non-progress DoS in SHIFT_JISX0213 -> UCS-4 conversion state handling (bsc#1277922).
    - CVE-2026-86805: TOCTOU race condition in the dynamic loader allows local attackers to escalate     privileges       (bsc#1282509).
    - CVE-2026-89092: nscd stack overflow leads to degraded DNS resolution (bsc#1282449).
    - CVE-2026-97399: one byte out-of-bounds read via function `strncasecmp` on Power8 can lead to a program     crash       (bsc#1283147).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4656-1 advisory.

    - CVE-2026-8674: reachable assert in `resolv/resolv_conf.c:update_from_conf` allows an attacker in a local     network to       trigger a process crash (bsc#1281297).
    - CVE-2026-86805: TOCTOU race condition in the dynamic loader allows local attackers to escalate     privileges       (bsc#1282509).
    - CVE-2026-89092: nscd stack overflow leads to degraded DNS resolution (bsc#1282449).
    - CVE-2026-97399: one byte out-of-bounds read via function `strncasecmp` on Power8 can lead to a program     crash       (bsc#1283147).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4654-1 advisory.

    - CVE-2026-86805: TOCTOU race condition in the dynamic loader allows local attackers to escalate     privileges       (bsc#1282509).
    - CVE-2026-89092: nscd stack overflow leads to degraded DNS resolution (bsc#1282449).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES11 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2026:4669-1 advisory.

    This update for glibc fixes the following issue:

    - CVE-2026-86805: TOCTOU race condition in the dynamic loader allows local attackers to escalate     privileges       (bsc#1282509).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - A time-of-check to time-of-use (TOCTOU) race condition in the dynamic loader (ld.so) of the GNU C Library
    (glibc) versions 2.14 through 2.44 allows a local attacker to escalate privileges. When expanding $ORIGIN
    in DT_RPATH for setuid/setgid (AT_SECURE) programs, glibc validates the lexically normalized search path
    against the trusted directories but then opens the raw, un-normalized path. On systems where the Linux
    fs.protected_hardlinks sysctl is disabled, a local attacker who hard-links such a program into an
    attacker-controlled directory and wins a race to replace an intermediate path component with a symbolic
    link can direct the loader outside the trusted directory, causing it to load an attacker-controlled shared
    object and execute arbitrary code with the elevated privileges of the program. Exploitation requires an
    installed setuid or setgid binary whose DT_RPATH uses $ORIGIN followed by ".." traversal that normalizes
    into a trusted directory, and the ability to hard-link that binary and win the race by swapping a path
    component for a symbolic link. Major Linux-based OS distributions ship with fs.protected_hardlinks enabled
    by default and mitigate the vulnerability. (CVE-2026-86805)

The remote SUSE Linux SLES16 / SLES_SAP16 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:23934-1 advisory.

    - CVE-2026-6368: invalid free via wordexp WRDE_APPEND rollback (bsc#1274726).
    - CVE-2026-6791: stack overflow in wordexp tilde expansion (bsc#1274723).
    - CVE-2026-8674: reachable assert in `resolv/resolv_conf.c:update_from_conf` allows an attacker in a local     network to       trigger a process crash (bsc#1281297).
    - CVE-2026-18374: heap buffer overflow in the fopen ccs extension (bsc#1277262).
    - CVE-2026-19499: buffer overflow in strfmon right-justification padding (bsc#1276892).
    - CVE-2026-19542: out-of-bounds array write in tdelete (bsc#1276946).
    - CVE-2026-77117: SHIFT_JISX0213 decoding lacks pending character reset (bsc#1277921).
    - CVE-2026-80489: EUC_JISX0213 decoding lacks pending character reset (bsc#1277922).
    - CVE-2026-86805: TOCTOU race condition in the dynamic loader allows local attackers to escalate     privileges       (bsc#1282509).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21968-1 advisory.

    - CVE-2026-6368: invalid free via wordexp WRDE_APPEND rollback (bsc#1274726).
    - CVE-2026-6791: stack overflow in wordexp tilde expansion (bsc#1274723).
    - CVE-2026-8674: reachable assert in `resolv/resolv_conf.c:update_from_conf` allows an attacker in a local     network to       trigger a process crash (bsc#1281297).
    - CVE-2026-18374: heap buffer overflow in the fopen ccs extension (bsc#1277262).
    - CVE-2026-19499: buffer overflow in strfmon right-justification padding (bsc#1276892).
    - CVE-2026-19542: out-of-bounds array write in tdelete (bsc#1276946).
    - CVE-2026-77117: SHIFT_JISX0213 decoding lacks pending character reset (bsc#1277921).
    - CVE-2026-80489: EUC_JISX0213 decoding lacks pending character reset (bsc#1277922).
    - CVE-2026-86805: TOCTOU race condition in the dynamic loader allows local attackers to escalate     privileges       (bsc#1282509).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A time-of-check to time-of-use (TOCTOU) race condition in the dynamic loader (ld.so) of the GNU C Library     (glibc) versions 2.14 through 2.44 allows a local attacker to escalate privileges. When expanding $ORIGIN     in DT_RPATH for setuid/setgid (AT_SECURE) programs, glibc validates the lexically normalized search path     against the trusted directories but then opens the raw, un-normalized path. On systems where the Linux     fs.protected_hardlinks sysctl is disabled, a local attacker who hard-links such a program into an     attacker-controlled directory and wins a race to replace an intermediate path component with a symbolic     link can direct the loader outside the trusted directory, causing it to load an attacker-controlled shared     object and execute arbitrary code with the elevated privileges of the program. Exploitation requires an     installed setuid or setgid binary whose DT_RPATH uses $ORIGIN followed by .. traversal that normalizes     into a trusted directory, and the ability to hard-link that binary and win the race by swapping a path     component for a symbolic link. Major Linux-based OS distributions ship with fs.protected_hardlinks enabled     by default and mitigate the vulnerability. (CVE-2026-86805)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
375677	AlmaLinux 9.2 [TuxCare] Security Update: compat-libpthread-nonshared / glibc / glibc-all-langpacks / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1793733350)	Nessus	Alma Linux Local Security Checks	Local	medium
369268	SUSE SLES15: glibc / glibc-32bit / glibc-devel / glibc-devel-32bit / etc (SUSE-SU-2026:4591-1)	Nessus	SuSE Local Security Checks	Local	critical
366065	SUSE SLED15: glibc / glibc-32bit / glibc-devel / glibc-devel-32bit / etc (SUSE-SU-2026:4656-1)	Nessus	SuSE Local Security Checks	Local	medium
366060	SUSE SLES12: glibc / glibc-32bit / glibc-devel / glibc-devel-32bit / etc (SUSE-SU-2026:4654-1)	Nessus	SuSE Local Security Checks	Local	medium
366040	SUSE SLES11: glibc / glibc-32bit / glibc-devel / glibc-devel-32bit / glibc-html / etc (SUSE-SU-2026:4669-1)	Nessus	SuSE Local Security Checks	Local	medium
473591	Chainguard: multiple glibc-2.44 packages, multiple ld-linux-2.44 packages, multiple nscd-2.44 packages, multiple pcprofiledump-2.44 packages, multiple sln-2.44 packages, tzutils-2.44: security update to 2.44-r8	Tenable Cloud Security	Chainguard Local Security Checks	Local	medium
473591	Chainguard: multiple glibc-2.44 packages, multiple ld-linux-2.44 packages, multiple nscd-2.44 packages, multiple pcprofiledump-2.44 packages, multiple sln-2.44 packages, tzutils-2.44: security update to 2.44-r8	Tenable Self-Hosted Container Security	Chainguard Local Security Checks	Local	medium
463609	Echo: glibc: security update to 2.41-12+deb13u4+e3	Tenable Cloud Security	Echo Local Security Checks	Local	medium
463609	Echo: glibc: security update to 2.41-12+deb13u4+e3	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
362572	SUSE SLES16: glibc / glibc-devel / glibc-devel-static / glibc-extra / etc (SUSE-SU-2026:23934-1)	Nessus	SuSE Local Security Checks	Local	critical
362508	openSUSE 16: cross-aarch64-glibc-devel / cross-ppc64le-glibc-devel / etc (openSUSE-SU-2026:21968-1)	Nessus	SuSE Local Security Checks	Local	critical
349177	Linux Distros Unpatched Vulnerability : CVE-2026-86805	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-86805

medium

Tenable Plugins

medium

critical

medium

medium

medium

medium

medium

medium

medium

critical

critical

medium