Hi, I've just released libcap-2.78 which includes a fix for a TOCTOU issue in libcap.
The issue has been allocated the following code: CVE-2026-4878. It is the subject of this private bug: https://bugzilla.redhat.com/show_bug.cgi?id=2447554 and is also written up in a github.com advisory which I will publish on Wednesday (this week). The github advisory tool characterizes the issue as CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H (Severity: Moderate 7 / 10). The fix for pretty much that whole range of libcap releases is this commit: https://git.kernel.org/pub/scm/libs/libcap/libcap.git/commit/?id=286ace1259992bd0c5d9016715833f2e148ac596 As the code is publicly available, there is no embargo in place for releasing fixes. Cheers Andrew PS I tried a few times to post to the private openwall list about this issue 9 days ago, but my email bounced (likely because I couldn't effectively follow the mail formatting requirements). I might have realized that the emails were bounced if gmail hadn't silently placed the bounced replies in my SPAM folder. Sorry about that.
