CVE-2026-41054: Suse Container Suse/sle-Micro-rancher/5.3:latest

High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days.

In `src/havegecmd.c`, the `socket_handler` function performs a credential check on the abstract UNIX socket (`\0/sys/entropy/haveged`). However, while it detects if the connecting user is not root (`cred.uid != 0`) and prepares a negative acknowledgement (`ASCII_NAK`), it **fails to stop execution**. The code proceeds to the `switch` statement, allowing any local unprivileged user to execute privileged commands such as `MAGIC_CHROOT`.

Affected products

• Suse Container Suse/sle-Micro-rancher/5.3:latest
• Suse Container Suse/sle-Micro-rancher/5.4:latest
• Suse Container Suse/sle-micro/5.5:latest
• Suse Image SLES15-SP4-SAP-Byos
• Suse Image SLES15-SP4-SAP-Byos-Azure
• Suse Image SLES15-SP4-SAP-Byos-EC2
• Suse Image SLES15-SP4-SAP-Byos-Gce
• Suse Image SLES15-SP4-SAP-Hardened
• Suse Image SLES15-SP4-SAP-Hardened-Byos
• Suse Image SLES15-SP4-SAP-Hardened-Byos-Azure
• Suse Image SLES15-SP4-SAP-Hardened-Byos-EC2
• Suse Image SLES15-SP4-SAP-Hardened-Byos-Gce
• Suse Image SLES15-SP4-SAP-Hardened-Gce
• Suse Suse Linux Enterprise Desktop 15 SP7
• Suse Suse Linux Enterprise High Performance Computing 15 SP4-Espos
• Suse Suse Linux Enterprise High Performance Computing 15 SP4-Ltss
• Suse Suse Linux Enterprise High Performance Computing 15 SP5-Espos
• Suse Suse Linux Enterprise High Performance Computing 15 SP5-Ltss
• Suse Suse Linux Enterprise High Performance Computing 15 SP7
• Suse Suse Linux Enterprise Micro 5.3
• Suse Suse Linux Enterprise Micro 5.4
• Suse Suse Linux Enterprise Micro 5.5
• Suse Suse Linux Enterprise Module For Basesystem 15 SP7
• Suse Suse Linux Enterprise Server 15 SP4-Ltss
• Suse Suse Linux Enterprise Server 15 SP5-Ltss
• and 9 more

Published 2026-05-20. Last modified 2026-07-24.