Description
In `src/havegecmd.c`, the `socket_handler` function performs a credential check on the abstract UNIX socket (`\0/sys/entropy/haveged`). However, while it detects if the connecting user is not root (`cred.uid != 0`) and prepares a negative acknowledgement (`ASCII_NAK`), it **fails to stop execution**. The code proceeds to the `switch` statement, allowing any local unprivileged user to execute privileged commands such as `MAGIC_CHROOT`.
References8
- bugzilla.suse.com/show_bug.cgi?id=CVE-2026-41054
- www.openwall.com/lists/oss-security/2026/05/19/3
- www.openwall.com/lists/oss-security/2026/05/19/4
- www.openwall.com/lists/oss-security/2026/05/19/5
- www.openwall.com/lists/oss-security/2026/05/20/1
- www.openwall.com/lists/oss-security/2026/05/21/17
- www.openwall.com/lists/oss-security/2026/05/22/1
- lists.debian.org/debian-lts-announce/2026/06/msg00005.html
Metrics
- CVSS 3.1
-
7.8
HIGH
Score source: CNA
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - EPSS — exploit probability
- 0% percentile: 8 · as of 14 November 2026
- CWE
- CWE-305
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.