Vulnerability Description
The ELF image activator cleared per-process ASLR preference flags for setuid binaries after the code that computes the PIE base address, rather than before. As a result, a user-requested ASLR disable was still in effect at the point where the base address was chosen. An unprivileged local user can disable ASLR for a setuid PIE binary by calling procctl(2) before execve(2). This makes exploitation of any separate memory corruption vulnerability in that binary significantly easier.
Related Weaknesses (CWE)
References
FAQ
What is CVE-2026-49414?
CVE-2026-49414 is a documented vulnerability. The ELF image activator cleared per-process ASLR preference flags for setuid binaries after the code that computes the PIE base address, rather than before. As a result, a user-requested ASLR disable...
How severe is CVE-2026-49414?
CVSS scoring is not yet available for CVE-2026-49414. Check NVD for updates.
Is there a patch for CVE-2026-49414?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.