https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-01T20:07:31.113661+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/cve-2026-41054 CVE-2026-41054 — Missing exit out of permission check in haveged could lead to root exploit 2026-10-01T20:07:32.203437+00:00

Affected: SUSE Container suse/sle-micro-rancher/5.3:latest, SUSE Container suse/sle-micro-rancher/5.4:latest, SUSE Container suse/sle-micro/5.5:latest, SUSE Image SLES15-SP4-SAP-BYOS, SUSE Image SLES15-SP4-SAP-BYOS-Azure, SUSE Image SLES15-SP4-SAP-BYOS-EC2, SUSE Image SLES15-SP4-SAP-BYOS-GCE, SUSE Image SLES15-SP4-SAP-Hardened, SUSE Image SLES15-SP4-SAP-Hardened-BYOS, SUSE Image SLES15-SP4-SAP-Hardened-BYOS-Azure and 24 more

In `src/havegecmd.c`, the `socket_handler` function performs a credential check on the abstract UNIX socket (`\0/sys/entropy/haveged`). However, while it detects if the connecting user is not root (`cred.uid != 0`) and prepares a negative acknowledgement (`ASCII_NAK`), it **fails to stop execution**. The code proceeds to the `switch` statement, allowing any local unprivileged user to execute privileged commands such as `MAGIC_CHROOT`.