CVE-2026-41054
Fixed in a distro release EPSS <1%CVSS 7.8
In `src/havegecmd.c`, the `socket_handler` function performs a credential check on the abstract UNIX socket (`\0/sys/entropy/haveged`). However, while it detects if the connecting user is not root (`cred.uid != 0`) and prepares a negative acknowledgement (`ASCII_NAK`), it **fails to stop execution**. The code proceeds to the `switch` statement, allowing any local unprivileged user to execute privileged commands such as `MAGIC_CHROOT`.
Products: Container suse/sle-micro-rancher/5.3:latest, Container suse/sle-micro-rancher/5.4:latest, Container suse/sle-micro/5.5:latest, SUSE Image SLES15-SP4-SAP-BYOS, SUSE Image SLES15-SP4-SAP-BYOS-Azure, SUSE Image SLES15-SP4-SAP-BYOS-EC2, SUSE Image SLES15-SP4-SAP-BYOS-GCE, SUSE Image SLES15-SP4-SAP-Hardened, SUSE Image SLES15-SP4-SAP-Hardened-BYOS, SUSE Image SLES15-SP4-SAP-Hardened-BYOS-Azure, SUSE Image SLES15-SP4-SAP-Hardened-BYOS-EC2, SUSE Image SLES15-SP4-SAP-Hardened-BYOS-GCE, SUSE Image SLES15-SP4-SAP-Hardened-GCE, SUSE Linux Enterprise Desktop 15 SP7, SUSE Linux Enterprise High Performance Computing 15 SP7, SUSE Linux Enterprise Module for Basesystem 15 SP7, SUSE Linux Enterprise Server 15 SP7, SUSE Linux Enterprise Server for SAP Applications 15 SP7, SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS, SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS, SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS, SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS, SUSE Linux Enterprise Micro 5.3, SUSE Linux Enterprise Micro 5.4, SUSE Linux Enterprise Micro 5.5, SUSE Linux Enterprise Server 15 SP4-LTSS, SUSE Linux Enterprise Server 15 SP5-LTSS, SUSE Linux Enterprise Server 15 SP6-LTSS, SUSE Linux Enterprise Server for SAP Applications 15 SP4, SUSE Linux Enterprise Server for SAP Applications 15 SP5, SUSE Linux Enterprise Server for SAP Applications 15 SP6, SUSE Manager Proxy LTS 4.3, SUSE Manager Retail Branch Server LTS 4.3, SUSE Manager Server LTS 4.3
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Alpine 3.20 | haveged | 1.9.21-r0 |
| Alpine 3.21 | haveged | 1.9.21-r0 |
| Alpine 3.22 | haveged | 1.9.21-r0 |
| Alpine 3.23 | haveged | 1.9.21-r0 |
| Alpine 3.24 | haveged | 1.9.21-r0 |
| Debian 12 | haveged | 1.9.14-1+deb12u1 |
| Debian 13 | haveged | 1.9.19-12+deb13u1 |
| Debian 14 | haveged | 1.9.21-1 |
| Ubuntu 25.10 | haveged | 1.9.19-12+deb13u1build0.25.10.1 |
| Ubuntu 26.04 LTS | haveged | 1.9.19-14ubuntu0.1 |
| Ubuntu Pro 22.04 LTS | haveged | 1.9.14-1ubuntu1+esm1~22.04.1 |
| Ubuntu Pro 24.04 LTS | haveged | 1.9.14-1ubuntu2+esm1~24.04.1 |
| openSUSE Leap 16.0 | haveged | 1.9.19-bp160.2.1 |
| openSUSE Tumbleweed | haveged | 1.9.21-1.1 |