The vulnerability CVE-2026-4878 exists in the libcap library's cap_set_file() function, where a TOCTOU race condition allows a local unprivileged user with write access to a parent directory to manipulate file capability updates. By exploiting this race condition, an attacker can redirect capability changes to files they control, enabling injection or removal of capabilities on executables and thereby escalating privileges. Red Hat has rated this issue as Important and has issued security advisories RHSA-2026:12423 and RHSA-2026:12441 providing updated libcap packages to fix the vulnerability in Red Hat Enterprise Linux 9 and 10 across multiple architectures.

Successful exploitation allows local unprivileged users to escalate privileges by modifying file capabilities on executables they should not control. This can compromise system security by enabling unauthorized privilege gains. The CVSS v3.1 base score is 6.7 (medium severity) with high impact on confidentiality, integrity, and availability. No known exploits in the wild have been reported at this time.

Red Hat has released official security updates for libcap that fix this TOCTOU race condition vulnerability. Users should apply the updated libcap packages as per Red Hat advisories RHSA-2026:12423 (for RHEL 10) and RHSA-2026:12441 (for RHEL 9). Detailed update instructions are available at https://access.redhat.com/articles/11258. Applying these updates fully mitigates the vulnerability. No additional mitigation steps are required beyond installing the official patches.