CVE-2026-41054: haveged Local Privilege Escalation on Gentoo — Detection, Patching, and Hardening Guide (GLSA-202608-11)

The Gentoo Security Team has published GLSA-202608-11, addressing CVE-2026-41054 — a high-severity vulnerability in haveged that permits a local attacker to gain unauthorized elevated privileges. All haveged versions below 1.9.21 are affected. If you run Gentoo systems with the haveged entropy daemon installed — and many headless servers, VMs, and container hosts do — a local foothold on that box can now be converted into root.

Local privilege escalation (LPE) bugs are routinely underestimated in triage queues because they require an authenticated session or code execution first. That logic fails in practice: LPEs are the second stage of nearly every modern intrusion chain. Ransomware operators, cryptominers, and post-exploitation frameworks depend on exactly this class of bug to move from a low-value web shell or phished user session to full system control. An LPE in a daemon that runs as root by design — as haveged does — is the shortest possible path to that outcome.

Treat this as a patch-now item on any Gentoo host where haveged is deployed, and use the detection content below to verify you weren't already hit.

Technical Analysis

Affected Products and Versions

Why haveged Is a High-Value Target

haveged exists to feed the kernel entropy pool using the HAVEGE algorithm, and it's deployed heavily on virtualized infrastructure where hardware RNG sources are weak — cloud VMs, VPS instances, and container hosts are the classic install base. Two architectural facts make this CVE dangerous:

1. The daemon runs with root privileges. It must, to interact with kernel entropy interfaces (/dev/random, RNDADDENTROPY ioctls). Any code execution within the daemon's context is root code execution.
2. It is long-lived and often unmanaged. haveged is a "set it and forget it" service. It rarely appears in patching sprints, it isn't covered by EDR agents on many minimal Linux builds, and it runs quietly for years. That makes it an ideal persistence-adjacent target: compromise it once, and you hold root on a box nobody is watching.

Exploitation Model (Defender's View)

Per the advisory, the flaw allows a local actor to gain privileges they are not authorized to hold. From a defensive standpoint, the exploitation chain to monitor for is:

1. Stage 1 (precondition): Attacker gains local access — phished SSH credential, compromised web application account, CI runner shell, or container escape landing on the host.
2. Stage 2 (this CVE): Attacker interacts with the vulnerable haveged component (below 1.9.21) to execute code or manipulate state in the daemon's root context.
3. Stage 3 (post-exploitation): Root-level actions follow — persistence (cron/systemd units, SSH authorized_keys, new users), credential dumping (/etc/shadow, memory scraping), log tampering, or lateral movement staging.

Exploitation Status

At the time of this writing, the Gentoo advisory does not confirm in-the-wild exploitation, and CVE-2026-41054 has not been listed in the CISA Known Exploited Vulnerabilities catalog. Do not let that lower your priority. LPE vulnerabilities historically move from disclosure to weaponization within days once exploit writers digest the advisory, and haveged's ubiquity on internet-facing VMs makes it an attractive target. Patch on the assumption that a public exploit is imminent.

Detection & Response

Because exploitation is local, your detection strategy should focus on three observable behaviors: (1) vulnerable haveged versions still running, (2) haveged spawning anomalous child processes or exhibiting abnormal behavior (a hallmark of daemon compromise), and (3) downstream post-exploitation activity consistent with a newly acquired root shell.

Sigma Rules

The first rule targets the single highest-fidelity signal: the haveged daemon spawning shell or command interpreters, which it never does in normal operation. The second detects modification of haveged's systemd unit or binary — a persistence move attackers make after abusing a root daemon. Note the logsource is linux, so these require process_creation auditing via auditd or Sysmon for Linux.

---
title: haveged Daemon Spawning Suspicious Child Process
id: 4b1e7c2a-9f3d-4a58-b612-8c7d5e6f1a09
status: experimental
description: Detects the haveged daemon spawning shells, interpreters, or common post-exploitation tooling. haveged runs as root and never legitimately spawns interactive child processes; this behavior strongly indicates daemon compromise or privilege escalation via CVE-2026-41054.
references:
  - https://linuxsecurity.com/advisories/gentoo/gentoo-glsa-202608-11-haveged-privilege
  - https://attack.mitre.org/techniques/T1068/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.privilege_escalation
  - attack.t1068
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith: '/haveged'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/zsh'
      - '/python'
      - '/python3'
      - '/perl'
      - '/nc'
      - '/ncat'
      - '/socat'
      - '/curl'
      - '/wget'
  condition: selection_parent and selection_child
falsepositives:
  - Extremely rare; custom init scripts wrapping haveged. Investigate every hit.
level: critical
---
title: Modification of haveged Binary or Systemd Unit
id: 8d2f5a91-3c4b-4e7a-a916-2b9c4d7e5f38
status: experimental
description: Detects writes to the haveged binary or its systemd unit files. After exploiting a root daemon, attackers frequently modify the service unit or binary to establish persistence that survives reboots.
references:
  - https://linuxsecurity.com/advisories/gentoo/gentoo-glsa-202608-11-haveged-privilege
  - https://attack.mitre.org/techniques/T1543/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.persistence
  - attack.privilege_escalation
  - attack.t1543.002
logsource:
  category: file_event
  product: linux
detection:
  selection:
    TargetFilename|contains:
      - '/usr/sbin/haveged'
      - '/usr/bin/haveged'
      - '/sbin/haveged'
      - '/etc/systemd/system/haveged.service'
      - '/usr/lib/systemd/system/haveged.service'
      - '/lib/systemd/system/haveged.service'
      - '/etc/init.d/haveged'
  condition: selection
falsepositives:
  - Legitimate package upgrades via emerge/portage. Correlate with package manager logs before dismissing.
level: high

KQL (Microsoft Sentinel / Defender)

This query hunts two things through Syslog ingestion: hosts still running a vulnerable haveged version, and suspicious child processes of the haveged daemon (if Sysmon for Linux or auditd process events are flowing into Sentinel).

// Hunt 1: Identify hosts running vulnerable haveged versions (< 1.9.21)
Syslog
| where TimeGenerated > ago(7d)
| where ProcessName =~ "haveged" or SyslogMessage has "haveged"
| summarize LastSeen = max(TimeGenerated), SampleMessages = take_any(SyslogMessage) by Computer, ProcessName
| project Computer, ProcessName, LastSeen, SampleMessages;

// Hunt 2: haveged spawning anomalous child processes (auditd / Sysmon for Linux via Syslog)
Syslog
| where TimeGenerated > ago(7d)
| where SyslogMessage has "haveged"
| where SyslogMessage has_any ("/bin/sh", "/bin/bash", "python", "perl", "/nc ", "ncat", "socat", "curl", "wget")
| extend Computer = HostName
| project TimeGenerated, Computer, ProcessName, SyslogMessage, HostIP
| order by TimeGenerated desc;

// Hunt 3: Post-exploitation indicators on hosts where haveged is installed — new user creation, shadow access, systemd persistence
Syslog
| where TimeGenerated > ago(7d)
| where SyslogMessage has_any ("useradd", "adduser", "/etc/shadow", "authorized_keys", "systemctl enable", "new user")
| where Computer in (
    Syslog
    | where TimeGenerated > ago(30d)
    | where ProcessName =~ "haveged" or SyslogMessage has "haveged"
    | summarize by Computer
)
| project TimeGenerated, Computer, ProcessName, SyslogMessage
| order by TimeGenerated desc

Velociraptor VQL

Use this hunt artifact across your Linux fleet to identify running haveged processes, confirm their versions, and surface any unexpected child process trees or established network connections under the daemon.

-- Inventory haveged processes and flag anomalous children or network activity
SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Name =~ 'haveged'
   OR CommandLine =~ 'haveged'

-- Enumerate network connections held by haveged (it should hold none)
SELECT Pid, Name, Status, LocalIP, LocalPort, RemoteIP, RemotePort
FROM netstat()
WHERE Name =~ 'haveged'

-- Check on-disk haveged artifacts and service files for recent modification
SELECT FullPath, Mtime, Ctime, Size
FROM glob(globs=[
  '/usr/sbin/haveged',
  '/usr/bin/haveged',
  '/sbin/haveged',
  '/etc/systemd/system/haveged.service',
  '/usr/lib/systemd/system/haveged.service',
  '/lib/systemd/system/haveged.service',
  '/etc/init.d/haveged'
])
ORDER BY Mtime DESC

Any haveged process with an established outbound connection, or any service/binary file modified outside a documented package upgrade window, is an immediate IR trigger.

Remediation & Verification Script (Bash)

Run this on Gentoo hosts to confirm installed version, apply the fixed package, restart the service, and verify the result. It also performs a quick hygiene check for anomalous haveged child processes.

#!/usr/bin/env bash
# CVE-2026-41054 / GLSA-202608-11 — haveged remediation and verification
set -euo pipefail

echo "=== [1] Current haveged version ==="
if command -v haveged >/dev/null 2>&1; then
    haveged --version || true
else
    echo "haveged not installed via PATH; checking portage..."
fi
emerge --info 2>/dev/null | grep -i haveged || true
equery list haveged 2>/dev/null || qlist -Iv sys-apps/haveged 2>/dev/null || true

echo "=== [2] Checking for active exploitation indicators (BEFORE patching) ==="
# haveged should never have child processes or network sockets
pgrep -a haveged || echo "haveged not running"
for pid in $(pgrep haveged 2>/dev/null); do
    children=$(pgrep -P "$pid" 2>/dev/null || true)
    if [ -n "$children" ]; then
        echo "[!] ALERT: haveged PID $pid has child processes: $children"
        ps -o pid,ppid,user,cmd -p $children
    fi
done
ss -tulnp 2>/dev/null | grep -i haveged && echo "[!] ALERT: haveged holds a network socket" || echo "[+] No network sockets held by haveged"

echo "=== [3] Syncing and upgrading haveged to >= 1.9.21 ==="
emaint sync -r gentoo || emerge --sync
emerge --ask=n --update --oneshot '>=sys-apps/haveged-1.9.21'

echo "=== [4] Restarting service and verifying ==="
systemctl restart haveged 2>/dev/null || rc-service haveged restart 2>/dev/null || true
sleep 2
haveged --version
systemctl is-active haveged 2>/dev/null || rc-service haveged status 2>/dev/null || true

echo "=== [5] Post-patch integrity check ==="
stat -c '%y %n' /usr/sbin/haveged /usr/bin/haveged 2>/dev/null || true

echo "=== DONE: Confirm version reports 1.9.21 or later ==="

If step 2 surfaces child processes or sockets owned by haveged, stop and escalate to incident response before patching — patching first will destroy volatile evidence of the compromise.

Remediation

1. Upgrade immediately. Update haveged to version 1.9.21 or later via Portage: emerge --update --oneshot '>=sys-apps/haveged-1.9.21'. Restart the service afterward — a running daemon from the old package remains vulnerable until restarted.
2. Reference the official advisory. Full details are in Gentoo GLSA-202608-11: https://linuxsecurity.com/advisories/gentoo/gentoo-glsa-202608-11-haveged-privilege. Subscribe to gentoo-announce and run glsa-check regularly; glsa-check -t all will tell you exactly which outstanding GLSAs affect each host.
3. Inventory your exposure. You cannot patch what you haven't mapped. Use the VQL hunt above or a simple configuration management query to find every Gentoo (and non-Gentoo — haveged ships in Debian, Ubuntu, Fedora, RHEL-family, and Arch) host running haveged, and verify versions fleet-wide. Watch vendor channels for parallel advisories from other distributions packaging haveged.
4. Reduce the attack surface. Modern kernels (5.6+) have substantially improved entropy handling, and many deployments no longer need haveged at all. If /proc/sys/kernel/random/entropy_avail and application behavior are healthy without it, uninstall the daemon (emerge --unmerge sys-apps/haveged) rather than maintaining a root service you don't need. If you do need it, run it under systemd hardening directives (ProtectSystem=strict, ProtectHome=yes, NoNewPrivileges=yes, PrivateTmp=yes, RestrictNamespaces=yes) to constrain the blast radius of a future daemon compromise.
5. Hunt before you assume clean. LPE flaws are exploited quietly and leave little noise. Before patching, check for the indicators above: haveged child processes, held network sockets, recent modification of the binary or unit files, unexpected users, and new persistence mechanisms. Preserve logs and memory if anything anomalous surfaces.
6. Enforce patch SLAs for LPEs. High-severity local privilege escalations in root-running daemons should sit in the same SLA tier as internet-facing CVEs in your vulnerability management program — 7 days or less — because they are the load-bearing second stage of real intrusions.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub