CVE-2026-41054: haveged Privilege Escalation Vulnerability

CVE-2026-41054 Overview

CVE-2026-41054 is a local privilege escalation vulnerability in the haveged entropy daemon. The flaw resides in the socket_handler function within src/havegecmd.c, which manages connections to the abstract UNIX socket \0/sys/entropy/haveged. The function correctly verifies the peer credentials and identifies non-root callers, but it fails to terminate execution after preparing the negative acknowledgement. Control flow continues into the command switch statement, allowing any local unprivileged user to invoke privileged operations such as MAGIC_CHROOT. The issue is classified under [CWE-305: Authentication Bypass by Primary Weakness].

Critical Impact
Any local unprivileged account can issue privileged commands to the haveged daemon, including MAGIC_CHROOT, leading to full compromise of confidentiality, integrity, and availability.

Affected Products

haveged daemon containing the vulnerable socket_handler implementation in src/havegecmd.c
Linux distributions packaging the affected haveged build (see SUSE Bugzilla advisory)
Systems exposing the abstract UNIX socket \0/sys/entropy/haveged to local users

Discovery Timeline

2026-05-20 - CVE-2026-41054 published to NVD
2026-05-20 - Last updated in NVD database

Technical Details for CVE-2026-41054

Vulnerability Analysis

The haveged daemon exposes a control interface over an abstract UNIX domain socket. Privileged commands sent across this socket are intended to be restricted to the root user. The socket_handler function in src/havegecmd.c retrieves the peer credentials with SO_PEERCRED and compares cred.uid against 0. When the connecting user is non-root, the handler stages an ASCII_NAK response intended to reject the request.

The defect lies in missing control flow termination. After staging the negative acknowledgement, the function does not return, break, or otherwise exit the request path. Execution falls through into the command dispatch switch statement. This allows unprivileged callers to trigger handlers such as MAGIC_CHROOT, which performs a chroot operation in the context of the privileged daemon.

Root Cause

The root cause is an incomplete authentication check. The code detects the unauthorized caller but never enforces the decision. A missing exit path after the credential comparison transforms the check into an advisory log step. This is a textbook instance of [CWE-305], where the authentication primary is present but is not the gating condition for sensitive operations.

Attack Vector

Exploitation requires a local account on the host running the vulnerable haveged daemon. The attacker connects to the abstract UNIX socket \0/sys/entropy/haveged and sends a privileged command frame. Because the handler proceeds past the failed credential check, the daemon executes the request with its own elevated privileges. Operations such as MAGIC_CHROOT can be abused to manipulate the runtime environment of a root-owned process, resulting in privilege escalation.

No public proof-of-concept is referenced in the advisory data. Technical discussion is available on the Openwall oss-security list and the SUSE Bugzilla entry.

Detection Methods for CVE-2026-41054

Indicators of Compromise

Connections to the abstract UNIX socket \0/sys/entropy/haveged originating from non-root UIDs.
Unexpected chroot activity performed by the haveged process, observable through audit or eBPF tracing.
haveged child processes or file system operations inconsistent with normal entropy-gathering behavior.

Detection Strategies

Enable Linux audit rules on the connect syscall targeting abstract sockets and correlate with haveged PID activity.
Monitor chroot syscalls invoked by haveged using auditd or eBPF probes; the daemon should not perform chroot during normal operation.
Review process accounting for unprivileged users opening sockets in the abstract namespace immediately followed by haveged privileged actions.

Monitoring Recommendations

Alert on any non-root process establishing a connection to \0/sys/entropy/haveged.
Track haveged parent-child process trees and flag deviations from the baseline command set.
Forward auditd events and syscall telemetry to a centralized analytics platform for retroactive hunting against the indicators above.

How to Mitigate CVE-2026-41054

Immediate Actions Required

Inventory hosts running haveged and identify those exposing the control socket to local users.
Apply vendor-supplied patches as soon as they are published by the upstream project and downstream distributions.
Restrict local shell access on affected systems until patches are deployed.

Patch Information

No fixed version is enumerated in the NVD record at publication time. Track the SUSE Bugzilla entry for CVE-2026-41054 and the Openwall oss-security threads (thread 1, thread 2, thread 3, thread 4) for the upstream fix that adds an explicit exit after the failed credential check in socket_handler.

Workarounds

Stop and disable the haveged service on systems where it is not required: systemctl disable --now haveged.
Where haveged must run, restrict local interactive access and remove untrusted local accounts.
Consider replacing haveged with the in-kernel entropy sources available on modern Linux kernels, which no longer require a userspace helper.

bash

# Configuration example: disable the vulnerable daemon until a patch is applied
sudo systemctl stop haveged
sudo systemctl disable haveged

# Verify the abstract socket is no longer present
ss -xl | grep '/sys/entropy/haveged'