CVE-2026-49413 – Flaw in Linuxulator execution of setugid binaries

CVE ID :CVE-2026-49413

Published : June 27, 2026, 9:08 a.m. | 37 minutes ago

Description :The Linuxulator determined whether a binary was set-user-ID or set-group-ID by checking the P_SUGID process flag. During execve(2), this flag is not yet set at the point where the auxiliary vector is constructed, so AT_SECURE was incorrectly set to zero for set-user-ID and set-group-ID executables.

An unprivileged local user can inject a shared library via LD_PRELOAD into a set-user-ID or set-group-ID Linux binary, gaining the privileges of that binary.

Severity: 0.0 | NA

Visit the link for more details, such as CVSS details, affected products, timeline, and more…