The ELF core dump code counted the number of dumpable VM map entries, allocated a buffer for the corresponding program headers, then iterated over… (CVE-2026-58088)

The ELF core dump code counts the number of dumpable VM map entries and allocates a buffer for the corresponding program headers. It then iterates over the map a second time to populate these headers. However, if a process sharing the address space via rfork(2) mutates the map between these two passes, the second pass may write program headers beyond the allocated buffer's end. This results in an out-of-bounds write on the kernel heap. An unprivileged local user sharing the address space with a process that dumps core can exploit this to potentially escalate privileges. The vulnerability is classified under CWE-362 (Race Condition).

An unprivileged local user can cause an out-of-bounds write on the kernel heap by exploiting a race condition in the ELF core dump code. This can lead to privilege escalation, allowing the attacker to gain higher privileges on the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.