Time-of-check Time-of-use (TOCTOU) Race Condition in cups - #VU154070
Published: October 12, 2026
Vulnerability identifier: #VU154070
CSH Severity: Low
CVSS v4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-367
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local privileged user to modify system directory ownership and permissions.
The vulnerability exists due to a time-of-check time-of-use race condition in cupsdCheckPermissions() in scheduler/conf.c when checking and repairing directory permissions. A local privileged user can replace CacheDir/rss with a symbolic link between the initial lstat() check and subsequent chown() or chmod() operations to modify system directory ownership and permissions.
Exploitation requires execution as the lp user and CUPS administrator access to trigger the permission check. The directory containing CacheDir/rss must be group-writable.
Affected software
cups
Remediation
Install security update from vendor's website.
cups - update to 2.4.20