canonical ubuntu-linux CVE-2026-61897 is a vulnerability in Canonical Ubuntu Linux
Published on August 20, 2026

accountsservice: incomplete privilege drop when running Ubuntu-specific language helper scripts
An Ubuntu-specific patch to AccountsService before 23.13.9-8ubuntu7 only partially drops privileges before launching language helper scripts. It changes the effective UID/GID to the target user but leaves the real UID as 0 (root). A shell spawned by a helper script inherits ruid=0 and may reset its effective UID to root, enabling local privilege escalation.

Vendor Advisory NVD

Weakness Type

Improper Check for Dropped Privileges

The software attempts to drop privileges but does not check or incorrectly checks to see if the drop succeeded. If the drop fails, the software will continue to run with the raised privileges, which might provide additional access to unprivileged users.


Products Associated with CVE-2026-61897

Want to know whenever a new CVE is published for Canonical Ubuntu Linux? stack.watch will email you.

 

Affected Versions

Canonical accountsservice: