Fixed: local root exploit in haveged, fixed in 1.9.21, CVE-2026-41054

[Marcus Meissner <meissner () suse de>]

Hi,

If you are using haveged, todays release fixes a local root exploit.

https://github.com/jirka-h/haveged/releases

Release 1.9.21 — Security fix for CVE-2026-41054

Fix privilege escalation via command socket (CVE-2026-41054) - the uid
check sent a NAK to non-root callers but did not exit the function,
allowing unprivileged local users to send commands to the root-running
daemon via the abstract UNIX socket.

Problem was found by Gemini Pro, operated by Dirk Mueller of SUSE.

https://bugzilla.suse.com/show_bug.cgi?id=1264086

The bug was added in 1.9.3.

Ciao, Marcus
-- 
Marcus Meissner (he/him), Distinguished Engineer / Senior Project Manager Security
SUSE Software Solutions Germany GmbH, Frankenstrasse 146, 90461 Nuernberg, Germany
GF: Jochen Jaser, Andrew McDonald, Werner Knoblich, HRB 36809, AG Nuernberg