CVE-2026-58302: LinuxCNC rtapi_app Local Privilege Escalation

Technical summary

CVE-2026-58302 is a local privilege escalation vulnerability in rtapi_app, a setuid-root binary in LinuxCNC-uspace. The vulnerability stems from insufficient path validation when loading shared library modules via dlopen(). An attacker supplies a crafted module name containing path traversal sequences (e.g., '../../') to redirect module loading to an arbitrary shared library under their control. Because rtapi_app retains elevated privileges throughout the module-loading phase, the attacker's library executes with root context. The flaw is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). Exploitation requires only local access and no special privileges or user interaction.

Business impact

Successful exploitation grants an unprivileged local user complete root access to the affected system. In manufacturing and industrial control environments where LinuxCNC is commonly deployed (machine tools, CNC systems), this translates to direct control over physical machinery, data, and network connectivity. An attacker could alter production parameters, steal intellectual property, sabotage equipment, or use the compromised system as a pivot point to attack adjacent industrial infrastructure. Organizations relying on LinuxCNC should treat this as a critical risk to operational technology security.

Affected systems

LinuxCNC versions prior to 2.9.9 are affected, specifically the linuxcnc-uspace distribution variant. The vulnerability is specific to systems where rtapi_app is installed with setuid-root permissions. LinuxCNC runs primarily on Linux systems used for numerical control and computer-aided manufacturing; typical deployments involve dedicated industrial machines, workstations, and embedded controllers in manufacturing environments.

Exploitability

This vulnerability is straightforward to exploit. No special privileges, credentials, or user interaction are required—only local shell access. An attacker can craft a malicious shared library, then invoke rtapi_app with a path-traversal module name pointing to that library. The absence of complexity in exploitation (AC:L in the CVSS vector) and the immediate privilege escalation to root make this a high-risk flaw from an operational perspective. The vulnerability is not currently listed in CISA's Known Exploited Vulnerabilities catalog, but the simplicity of exploitation warrants rapid patching regardless.

Remediation

Upgrade LinuxCNC to version 2.9.9 or later. Organizations unable to upgrade immediately should restrict local shell access to rtapi_app by limiting the user accounts permitted to invoke it, and consider disabling or isolating affected systems until patching is feasible. Verify that rtapi_app retains setuid-root permissions only where functionally necessary.

Patch guidance

The fix is available in LinuxCNC 2.9.9 and later versions. Patch by updating your LinuxCNC installation through your distribution package manager or by downloading the latest source from the official LinuxCNC repository and rebuilding. Confirm the update with version checks (e.g., rtapi_app --version or equivalent). If using a vendor-packaged version, check your vendor's update schedule. Test patched systems in a non-production environment before full deployment to ensure compatibility with your CNC configurations.

Detection guidance

Monitor system logs for failed or unusual module-load attempts by rtapi_app. Watch for suspicious dlopen() calls with path-traversal sequences in process arguments and environment variables. Endpoint Detection & Response (EDR) systems should flag privilege escalation events where rtapi_app transitions from unprivileged user to root. File-integrity monitoring on shared library directories can detect unauthorized library placement. Review process accounting logs for unexpected rtapi_app invocations by regular users. Additionally, audit which user accounts have permission to execute rtapi_app and ensure principle of least privilege is enforced.

Why prioritize this

HIGH priority (CVSS 8.4) warrants immediate action. The combination of ease of exploitation (no privileges required, straightforward path traversal), direct privilege escalation to root, and deployment in safety-critical industrial control systems elevates risk significantly. While not yet in the KEV catalog, the simplicity and impact justify treating this as a production emergency in any environment running LinuxCNC.

Risk score, explained

CVSS 3.1 score of 8.4 (HIGH) reflects: Attack Vector Local (AV:L) — requires local system access; Attack Complexity Low (AC:L) — no special conditions required; Privileges Required None (PR:N) — unauthenticated local user can exploit; User Interaction None (UI:N) — no user action needed; Scope Unchanged (S:U) — impact limited to the affected system; Confidentiality High (C:H), Integrity High (I:H), Availability High (A:H) — full compromise of system assets. The high confidentiality, integrity, and availability impact combined with trivial exploitability justifies the 8.4 score and HIGH severity classification.

Frequently asked questions