CVE-2026-62840: TOCTOU race condition in Linux Kernel enables local privilege escalation · ZeroHour

CVE-2026-62840

mass

TOCTOU race condition in Linux Kernel enables local privilege escalation

CVSS 3.1

7.0 high

EPSS

—

Published

Oct 13, 2026 (3d ago)

Modified

Oct 16, 2026

AI analysis

A time-of-check time-of-use (TOCTOU) race condition in the Linux Kernel allows an authorized local user to elevate privileges on an affected system. The flaw is triggered when a local attacker exploits a timing gap between a kernel check on a resource and its subsequent use, manipulating the state in between to gain unintended access. Successful exploitation yields high impact on confidentiality, integrity, and availability, effectively giving the attacker elevated (root-level) privileges on the host. Any system running a vulnerable kernel version is affected, though exploitation requires local access and existing low-privilege credentials, and the attack complexity is rated high. No public proof-of-concept or in-the-wild exploitation is currently known.

What to do: Apply kernel updates as soon as patched versions are distributed by your distro vendor, and reboot to load the new kernel. Restrict untrusted local account access and use mitigations such as reduced privileges, containers with seccomp/AppArmor, and monitoring for anomalous local privilege escalation. Verify which kernel versions your distro has marked as fixed, since affected version ranges were not specified at assignment time.

Affected

Linux Kernel

—

Estimated exposure

masspotentially hundreds of millions of devices (Linux kernel underpins most servers, Android devices, and cloud infrastructure) — Linux runs the majority of public cloud instances, web servers, and Android devices, so vulnerable kernels could plausibly span >100M systems, though the true count depends on which kernel versions are fixed.

Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.

Description

Time-of-check time-of-use (toctou) race condition in Linux Kernel allows an authorized attacker to elevate privileges locally.

Weakness: CWE-367
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (—)

CVE-2026-62840

In the news1 stories

The October 2026 Security Update Review