https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-05T18:12:34.549180+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2026-12851 bdu:2026-12851 2026-10-05T18:12:34.701905+00:00 bdu:2026-12851 https://cve.radiocsirt.org/vuln/bell-cve-2026-41054 BELL-CVE-2026-41054 2026-10-05T18:12:34.701961+00:00

Affected: Alpaquita:23: haveged, Alpaquita:25: haveged, Alpaquita:stream: haveged

 https://cve.radiocsirt.org/vuln/euvd-2026-324836 EUVD-2026-324836 2026-10-05T18:12:34.702003+00:00 EUVD-2026-324836 https://cve.radiocsirt.org/vuln/fkie_cve-2026-41054 fkie_cve-2026-41054 2026-10-05T18:12:34.702017+00:00

In `src/havegecmd.c`, the `socket_handler` function performs a credential check on the abstract UNIX socket (`\0/sys/entropy/haveged`). However, while it detects if the connecting user is not root (`cred.uid != 0`) and prepares a negative acknowledgement (`ASCII_NAK`), it **fails to stop execution**. The code proceeds to the `switch` statement, allowing any local unprivileged user to execute privileged commands such as `MAGIC_CHROOT`.

 https://cve.radiocsirt.org/vuln/ghsa-c5g3-m8p9-m3gh GHSA-c5g3-m8p9-m3gh 2026-10-05T18:12:34.702044+00:00

In `src/havegecmd.c`, the `socket_handler` function performs a credential check on the abstract UNIX socket (`\0/sys/entropy/haveged`). However, while it detects if the connecting user is not root (`cred.uid != 0`) and prepares a negative acknowledgement (`ASCII_NAK`), it **fails to stop execution**. The code proceeds to the `switch` statement, allowing any local unprivileged user to execute privileged commands such as `MAGIC_CHROOT`.

 https://cve.radiocsirt.org/vuln/msrc_cve-2026-41054 msrc_CVE-2026-41054 — Missing exit out of permission check in haveged could lead to root exploit 2026-10-05T18:12:34.702061+00:00 msrc_CVE-2026-41054 https://cve.radiocsirt.org/vuln/opensuse-su-2026:10833-1 openSUSE-SU-2026:10833-1 — haveged-1.9.21-1.1 on GA media 2026-10-05T18:12:34.702078+00:00

haveged-1.9.21-1.1 on GA media

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-41054 UBUNTU-CVE-2026-41054 2026-10-05T18:12:34.702094+00:00

Affected: Ubuntu:Pro:22.04:LTS: haveged, Ubuntu:Pro:24.04:LTS: haveged, Ubuntu:25.10: haveged, Ubuntu:26.04:LTS: haveged

In `src/havegecmd.c`, the `socket_handler` function performs a credential check on the abstract UNIX socket (`\0/sys/entropy/haveged`). However, while it detects if the connecting user is not root (`cred.uid != 0`) and prepares a negative acknowledgement (`ASCII_NAK`), it **fails to stop execution**. The code proceeds to the `switch` statement, allowing any local unprivileged user to execute privileged commands such as `MAGIC_CHROOT`.