The rtapi_app binary in LinuxCNC before version 2.9.9 runs as a SUID root program and loads shared libraries via dlopen() based on a module name supplied by the user. The program does not properly validate this module name, allowing a local user to perform a path‑traversal attack and load an arbitrary shared library. Because the process retains elevated privileges during the load, the attacker gains root access on the affected system.

LinuxCNC LinuxCNC versions prior to 2.9.9 (including 2.9.8 and earlier). The vulnerability exists in the linuxcnc-uspace component, specifically rtapi_app.

The vulnerability carries a CVSS score of 8.4 and is considered a high‑risk, local privilege escalation. No EPSS score is available, and it is not listed in the CISA KEV catalog. The attack requires an unprivileged local account with access to the rtapi_app binary. The attacker simply supplies a crafted module path that reaches an arbitrary location on the filesystem, then the elevated process loads the malicious library, achieving full system compromise.