CVE-2026-58302: LinuxCNC Privilege Escalation Vulnerability

CVE-2026-58302 Overview

CVE-2026-58302 is a local privilege escalation vulnerability in LinuxCNC versions before 2.9.9. The flaw exists in rtapi_app, a component of the linuxcnc-uspace package that is installed with the SUID root bit set. The program loads shared library modules through dlopen() using a user-supplied module name without adequate validation. An unprivileged local user can supply a name containing path traversal sequences to load an arbitrary shared library while the process holds elevated privileges, resulting in root code execution.

Critical Impact
A local attacker with shell access to a LinuxCNC workstation can escalate to root by abusing the SUID rtapi_app binary to load an attacker-controlled shared object.

Affected Products

LinuxCNC linuxcnc-uspace package versions prior to 2.9.9
Debian systems packaging vulnerable LinuxCNC builds (see Debian Bug #1140943)
Any distribution shipping rtapi_app as SUID root from LinuxCNC < 2.9.9

Discovery Timeline

2026-06-30 - CVE-2026-58302 published to NVD
2026-06-30 - Last updated in NVD database

Technical Details for CVE-2026-58302

Vulnerability Analysis

The defect resides in the do_load_cmd() function inside src/rtapi/uspace_rtapi_app.cc and src/rtapi/uspace_rtapi_main.cc. The function accepts a module name from the calling user and constructs a path of the form EMC2_RTLIB_DIR/name.so. This constructed path is then passed directly to dlopen() while the process still runs with root privileges gained through the SUID bit. Because the name is not validated for directory separators or parent-directory sequences, the resulting path can be redirected outside EMC2_RTLIB_DIR to any attacker-controlled shared object on disk. This class of flaw is tracked under [CWE-22] Improper Limitation of a Pathname to a Restricted Directory.

Root Cause

The root cause is missing input sanitization on the module name argument. The code trusts the caller to provide a simple identifier, but the string is inserted into a filesystem path without rejecting / or .. sequences. Combined with the SUID root installation of rtapi_app, this trust boundary violation transforms a path traversal issue into a full local privilege escalation.

Attack Vector

An unprivileged local user places a crafted shared object anywhere they can write, then invokes rtapi_app with a module name that uses .. traversal to reach that object. The dynamic loader executes the library's constructor with root privileges, yielding a root shell or arbitrary root command execution.

text

// Source: https://github.com/LinuxCNC/linuxcnc/commit/00d534c87464a3ed446656998aa02b8abc74b391
// Security patch in src/rtapi/uspace_rtapi_app.cc - Sanitize name for module
 static int do_load_cmd(string name, vector<string> args) {
     void *w = modules[name];
     if(w == NULL) {
+        //Sanitize the name
+        if(name.find("/") != std::string::npos || name.find("..") != std::string::npos){
+            rtapi_print_msg(RTAPI_MSG_ERR, "%s: Not allowed as module name. Slashes or with \"..\" (even /a..b/) are not allowed.\n", name.c_str());
+            return -1;
+        }
         char what[LINELEN+1];
         snprintf(what, LINELEN, "%s/%s.so", EMC2_RTLIB_DIR, name.c_str());
         void *module = modules[name] = dlopen(what, RTLD_GLOBAL | RTLD_NOW);

The patch rejects any module name containing / or .. before the path is assembled and passed to dlopen(). A parallel fix was applied to src/rtapi/uspace_rtapi_main.cc in commit ea7cd579.

Detection Methods for CVE-2026-58302

Indicators of Compromise

Execution of rtapi_app by non-root, non-linuxcnc service accounts, especially from interactive shells
Creation of .so files in user-writable directories such as /tmp, /var/tmp, or user home directories shortly before rtapi_app invocation
Unexpected root-owned processes spawned as children of rtapi_app
Presence of LinuxCNC packages older than 2.9.9 with the SUID bit still set on rtapi_app

Detection Strategies

Audit execve events for rtapi_app where the command line includes / or .. in the module name argument
Use auditd or eBPF-based sensors to log dlopen() targets resolved outside the EMC2_RTLIB_DIR path
Compare installed LinuxCNC package versions against 2.9.9 across the fleet
Alert on SUID binaries loading shared objects from world-writable paths

Monitoring Recommendations

Enable process-lineage telemetry on industrial control workstations running LinuxCNC and forward it to a centralized analytics platform
Monitor filesystem writes of ELF shared objects into non-standard library paths
Track UID transitions from unprivileged users to root originating from rtapi_app

How to Mitigate CVE-2026-58302

Immediate Actions Required

Upgrade linuxcnc-uspace to version 2.9.9 or later on all affected hosts
Restrict interactive local access to LinuxCNC controllers to trusted operators only
Inventory SUID binaries and remove the SUID bit from rtapi_app on systems that cannot be immediately patched, understanding this may break LinuxCNC functionality
Review shell history and audit logs for prior invocations of rtapi_app with suspicious module names

Patch Information

The upstream fix is included in LinuxCNC 2.9.9. Refer to the LinuxCNC v2.9.8...v2.9.9 diff and the sanitization commits 00d534c8 and ea7cd579. Debian users should track Debian Bug #1140943 for distribution-specific packages.

Workarounds

Remove the SUID root bit from rtapi_app with chmod u-s where LinuxCNC realtime functionality is not required
Confine LinuxCNC operator accounts to non-interactive sessions and disable shell access for users who do not need it
Apply mandatory access controls such as AppArmor or SELinux profiles restricting which shared objects rtapi_app may load

bash

# Verify LinuxCNC version and inspect rtapi_app permissions
dpkg -l linuxcnc-uspace | awk '/linuxcnc-uspace/ {print $3}'
find / -name rtapi_app -perm -4000 -ls 2>/dev/null

# Emergency mitigation on unpatched hosts (removes SUID; may disable functionality)
sudo chmod u-s $(command -v rtapi_app)

# Preferred remediation: upgrade to 2.9.9 or later
sudo apt update && sudo apt install --only-upgrade linuxcnc-uspace