The libcap library, which manages POSIX capabilities, contains a TOCTOU race condition vulnerability in the cap_set_file() function that can lead to privilege escalation (CVE-2026-4878). This vulnerability affects Red Hat Enterprise Linux 9.4 across several architectures. Red Hat Product Security has released updated libcap packages to fix this issue. The advisory classifies the security impact as Important. No CVSS score is provided in the advisory, but the vulnerability is rated high severity in the source data. The vendor advisory includes detailed package updates and remediation instructions.

Successful exploitation of this vulnerability could allow an attacker to escalate privileges on affected Red Hat Enterprise Linux 9.4 systems by exploiting a race condition in the libcap library. This could lead to unauthorized access or control over system resources. There are no reports of active exploitation in the wild at this time.

Red Hat has released updated libcap packages that fix the TOCTOU race condition vulnerability. Users of affected Red Hat Enterprise Linux 9.4 versions should apply the security update as described in the Red Hat advisory RHSA-2026:20595 and the referenced article https://access.redhat.com/articles/11258. Applying these official patches is the recommended and effective mitigation. No additional mitigation steps are indicated by the vendor.