GNU C Library EUVD-2026-84540

Exploitation requires ALL of: (1) an installed setuid or setgid (AT_SECURE) binary whose DT_RPATH uses $ORIGIN followed by '..' traversal that lexically normalizes back into a trusted directory; (2) the Linux fs.protected_hardlinks sysctl being DISABLED - major distributions enable it by default and are mitigated; (3) a local unprivileged account with the ability to hard-link the target binary into an attacker-controlled directory; and (4) winning a TOCTOU race to replace an intermediate path component with a symbolic link between validation and open(). These narrow, compounding preconditions - non-default kernel setting plus a specific RPATH construction plus a race win - sharply limit realistic exploitation despite glibc's ubiquity.

The provided CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, score 7.0) describes a local, high-complexity privilege escalation requiring an existing low-privileged account - not a remotely reachable flaw despite the 'RCE' tag. No EPSS score, CISA KEV listing, or POC is present in the input, so exploitation status is 'no public exploit identified at time of analysis.' The AC:H rating is well justified: successful exploitation requires winning a filesystem race AND a non-default kernel configuration (fs.protected_hardlinks disabled), and the vulnerability itself notes that major distributions ship this sysctl enabled by default and are therefore mitigated. This is a real, high-quality privilege-escalation primitive in ubiquitous software, but the compounding preconditions (rare setuid/setgid binary with a $ORIGIN+'..' DT_RPATH, disabled hardlink protection, and a race win) make widespread opportunistic exploitation unlikely; it is a hardening/patch-management priority rather than an emergency. No signals conflict, but note the missing EPSS/KEV/POC data means real-world exploitation interest cannot be quantified from the input.

On a system where an administrator has disabled fs.protected_hardlinks, a local attacker with a shell account identifies a setuid/setgid binary whose DT_RPATH uses $ORIGIN followed by '..' traversal. They hard-link the binary into a directory they control, launch it, and race to swap an intermediate path component for a symlink between the loader's path validation and its open() call, causing ld.so to load an attacker-controlled shared object and execute code with the binary's elevated privileges. No public exploit code is identified in the provided data.