CVE-2026-49413: Flaw in Linuxulator execution of setugid binaries
The Linuxulator determined whether a binary was set-user-ID or set-group-ID by checking the PSUGID process flag. During execve(2), this flag is not yet set at the point where the auxiliary vector is constructed, so ATSECURE was incorrectly set to zero for set-user-ID and set-group-ID executables.
An unprivileged local user can inject a shared library via LDPRELOAD into a set-user-ID or set-group-ID Linux binary, gaining the privileges of that binary.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-49413?
CVE-2026-49413 has a risk severity score of 76.
How do I fix CVE-2026-49413?
To fix CVE-2026-49413, update the Linuxulator to a version that correctly handles set-user-ID and set-group-ID binaries.
What systems are affected by CVE-2026-49413?
CVE-2026-49413 affects systems running the Linuxulator in FreeBSD.
What types of executables are impacted by CVE-2026-49413?
CVE-2026-49413 impacts set-user-ID and set-group-ID executables that are incorrectly handled.
What is the cause of the vulnerability in CVE-2026-49413?
The vulnerability in CVE-2026-49413 is caused by the improper setting of the AT_SECURE auxiliary vector flag during the execution of set-user-ID and set-group-ID binaries.