CVE-2026-85879: Windows Subsystem for Linux Race Condition

CVE-2026-85879 Overview

CVE-2026-85879 is a time-of-check time-of-use (TOCTOU) race condition in Windows Subsystem for Linux (WSL). An authorized local attacker can exploit the flaw to elevate privileges on an affected host. The weakness is tracked under CWE-367: Time-of-check Time-of-use Race Condition.

Microsoft published the advisory on October 13, 2026. Exploitation requires local access and low privileges, but no user interaction. Successful exploitation compromises confidentiality, integrity, and availability on the targeted system.

Critical Impact
A local attacker who wins the race between resource validation and resource use in WSL can gain elevated privileges on the Windows host.

Affected Products

Windows Subsystem for Linux (WSL)
Windows client and server editions shipping WSL components
Refer to the Microsoft CVE-2026-85879 Advisory for the authoritative affected build list

Discovery Timeline

2026-10-13 - CVE-2026-85879 published to NVD
2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-85879

Vulnerability Analysis

CVE-2026-85879 is a TOCTOU race condition inside Windows Subsystem for Linux. WSL validates the state or properties of a resource at one moment, then operates on that resource at a later moment. An attacker running code with low privileges on the local system can modify the resource between the check and the use, redirecting a privileged operation to a target the attacker controls.

The practical outcome is local privilege escalation. By winning the race window, an attacker can cause WSL to perform a sensitive action against an attacker-chosen file, pipe, device, or object. This yields code execution or file manipulation in a higher-privileged security context.

The attack complexity is high because the attacker must repeatedly trigger the vulnerable code path and win a timing-sensitive race. No user interaction is required, and the scope remains unchanged within the host boundary.

Root Cause

The root cause is non-atomic handling of a security-relevant resource. WSL performs a check (for example, verifying ownership, path, or permissions) and later performs a use (opening, writing, or executing) without holding a lock or using an atomic file descriptor based operation that would bind the two steps together.

Attack Vector

The attack vector is local. An authenticated attacker executes code on the Windows host, triggers the vulnerable WSL operation, and simultaneously races to swap the target resource. Techniques typically include symlink swaps, directory junction replacement, or rapid replacement of a file after a validation call succeeds.

No verified public exploit is available at publication time. See the Microsoft CVE-2026-85879 Advisory for additional technical context.

Detection Methods for CVE-2026-85879

Indicators of Compromise

Repeated or anomalous invocations of WSL binaries such as wsl.exe and wslhost.exe from low-privileged user sessions
Creation and rapid deletion of symbolic links, junctions, or hard links inside directories used by WSL
Unexpected processes spawned by WSL service components running as SYSTEM
New SUID-equivalent artifacts or files written to locations writable only by privileged accounts

Detection Strategies

Hunt for processes that create a file, then immediately replace it with a symlink before a privileged WSL process accesses the same path
Correlate high-frequency file system operations against WSL-related paths with subsequent elevation events
Alert on child processes of WSL components that execute shells, script interpreters, or credential-access tools

Monitoring Recommendations

Enable Windows Sysmon events 1 (process creation), 11 (file create), and 15 (file create stream hash) on hosts with WSL installed
Collect WSL and Linux audit logs centrally and retain them long enough to reconstruct short race windows
Baseline normal WSL activity per user and flag deviations in process lineage or file access patterns

How to Mitigate CVE-2026-85879

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft CVE-2026-85879 Advisory as soon as it is available in your environment
Inventory all Windows hosts with WSL enabled using endpoint management tooling
Restrict local interactive logon on servers and developer workstations to trusted accounts

Patch Information

Microsoft issued the advisory for CVE-2026-85879 on October 13, 2026. Administrators should consult the Microsoft CVE-2026-85879 Advisory for the specific KB articles, build numbers, and deployment guidance applicable to each supported Windows version.

Workarounds

Disable the Windows Subsystem for Linux feature on hosts that do not require it using Disable-WindowsOptionalFeature -Online -FeatureName Microsoft-Windows-Subsystem-Linux
Remove local administrative rights from standard users to reduce the pool of accounts that can stage the race
Apply application control policies that block execution of unexpected binaries from user-writable paths

bash

# Verify and disable WSL on hosts where it is not required
Get-WindowsOptionalFeature -Online -FeatureName Microsoft-Windows-Subsystem-Linux
Disable-WindowsOptionalFeature -Online -FeatureName Microsoft-Windows-Subsystem-Linux -NoRestart