CVE-2026-107886: OpenPrinting CUPS Double-Free DoS Vulnerability

CVE-2026-107886 Overview

CVE-2026-107886 is a double-free vulnerability [CWE-415] in OpenPrinting CUPS versions before 2.4.20. The flaw resides in the printer-class management code path invoked by the CUPS-Add-Modify-Class operation. The add_class() function frees pclass->printers without nulling the pointer, leaving a dangling reference when subsequent validation fails. A later CUPS-Delete-Class request routed through cupsdDeletePrinter() frees the same allocation again. An authenticated client with class modification and deletion rights can crash the scheduler, producing a denial-of-service condition.

Critical Impact
An authenticated local attacker with @SYSTEM privileges can trigger a scheduler-wide denial of service against the CUPS print service.

Affected Products

OpenPrinting CUPS versions prior to 2.4.20
Linux and Unix distributions bundling vulnerable CUPS builds
Print servers exposing the CUPS scheduler to authorized administrators

Discovery Timeline

2026-10-09 - CVE-2026-107886 published to NVD
2026-10-09 - Last updated in NVD database

Technical Details for CVE-2026-107886

Vulnerability Analysis

The defect occurs in CUPS printer-class state management. When an authorized client issues a CUPS-Add-Modify-Class request that replaces an existing class member list, add_class() releases the memory backing pclass->printers. The function does not reset the pointer to NULL after the free. If validation of the updated class fails, the partially modified class object remains in memory with a dangling pointer still referencing the freed allocation.

A follow-up CUPS-Delete-Class request invokes cupsdDeletePrinter(), which attempts to release the same allocation again. The duplicate free corrupts the heap allocator's internal state and terminates the scheduler process. All queued jobs, IPP sessions, and client requests served by the scheduler fail until the service restarts.

Root Cause

The root cause is incomplete cleanup after a conditional free [CWE-415]. The pattern of freeing memory without clearing the owning pointer violates safe-free discipline. When the error path leaves the object partially constructed, the class retains an invalid reference that subsequent lifecycle operations treat as valid.

Attack Vector

Exploitation requires local access and authentication under the default CUPS policy, which restricts class administration to the @SYSTEM group. An attacker meeting those requirements submits a crafted CUPS-Add-Modify-Class IPP request that fails validation after the printer list is freed, then issues CUPS-Delete-Class to trigger the second free. The attack produces denial of service only; confidentiality and integrity are not affected. See the GitHub Security Advisory for the full technical description.

Detection Methods for CVE-2026-107886

Indicators of Compromise

Unexpected termination of the cupsd scheduler process followed by automatic restart by systemd or launchd.
Heap corruption signatures or double free or corruption messages in /var/log/cups/error_log or the system journal.
Sequences of CUPS-Add-Modify-Class requests immediately followed by CUPS-Delete-Class from the same authenticated client.

Detection Strategies

Enable CUPS LogLevel debug2 temporarily to capture IPP operation codes and correlate class modification failures with scheduler crashes.
Monitor for repeated cupsd segmentation faults or abort signals through the kernel audit subsystem.
Review access logs for administrative accounts issuing class management operations outside expected change windows.

Monitoring Recommendations

Alert on process termination events for cupsd with non-zero exit status or signal-based exits.
Track IPP request patterns targeting class endpoints, flagging rapid add-modify-delete sequences.
Forward CUPS error logs to a centralized logging platform for correlation with privileged user activity.

How to Mitigate CVE-2026-107886

Immediate Actions Required

Upgrade OpenPrinting CUPS to version 2.4.20 or later on all print servers and workstations.
Audit membership of the @SYSTEM group and remove accounts that do not require class administration rights.
Restrict network exposure of the CUPS scheduler to administrative management networks.

Patch Information

OpenPrinting addressed the double-free in CUPS 2.4.20. The fix ensures pclass->printers is cleared after being freed in add_class(), preventing cupsdDeletePrinter() from releasing the same allocation. Review the GitHub Security Advisory GHSA-pwg4-pv39-8c22 for commit references and distribution-specific backports.

Workarounds

Tighten the default cupsd.conf policy to require additional authentication for CUPS-Add-Modify-Class and CUPS-Delete-Class operations.
Disable remote administration by binding cupsd to the loopback interface only until patches are applied.
Configure the service manager to automatically restart cupsd on failure to limit outage duration.

bash

# Configuration example
# Restrict class administration in /etc/cups/cupsd.conf
<Limit CUPS-Add-Modify-Class CUPS-Delete-Class>
  AuthType Default
  Require user @SYSTEM
  Order deny,allow
  Deny from all
  Allow from 127.0.0.1
</Limit>