SetRootLanguage: Local privilege escalation in Ubuntu via AccountsService

A two-bug chain in Ubuntu’s AccountsService language update path allows any local user to obtain local root access. We call the vulnerability chain “SetRootLanguage” because a single call to the SetLanguage D-Bus method is all it takes to end up with root. The only prerequisite is that at least one non-English language pack is installed on the system. This blog post is a continuation of our previous research on local privilege escalation vulnerabilities in userland applications on Linux-based operating systems. The discovery came from targeted research into privilege escalation vectors in the Ubuntu desktop stack. The vulnerabilities were responsibly disclosed to Canonical and assigned CVE IDs. Ubuntu security advisories for all affected releases were published on the coordinated release date of 2026-07-21 16:00 UTC.

Affected versions, fixes and mitigations

The following table lists the affected Ubuntu distributions as of the coordinated release date:

Fix and mitigation

Canonical published Ubuntu Security Notices covering all affected releases on 2026-07-21:

• USN-8580-1: Ubuntu 25.10, 24.04 LTS, 22.04 LTS
• USN-8580-2: Ubuntu 20.04 LTS, 18.04 LTS, 16.04 LTS, 14.04 LTS (requires Ubuntu Pro)

Apply the available security updates immediately:

sudo apt-get update && sudo apt-get install --only-upgrade accountsservice libaccountsservice0

If updates cannot be applied immediately, note that the vulnerable branch in set-language-helper is only reached when at least one non-English language pack is installed. Removing non-English language packs prevents the vulnerable code path from being triggered, but is not a reliable long-term safeguard and should not be substituted for patching.

A language request that speaks root

During targeted local privilege escalation research, we turned our attention to the Ubuntu desktop stack, specifically the D-Bus services that manage user account settings. AccountsService is a daemon that lets desktop sessions read and modify account properties such as the display name, icon, and preferred language. It ships and runs by default on Ubuntu as root.

Root process, shell scripts, user-controlled input. We found the collision we were looking for. The vulnerability is a two-bug chain that allows any local user to obtain a root shell with a single D-Bus call. The first bug is an incomplete privilege drop in AccountsService, which sets only the effective UID to the unprivileged user before launching Ubuntu language helper scripts. The second bug is a shell injection by attacker controlled input. However, a successful exploitation requires that at least one non-English language pack is installed on the system.

Proof-of-Concept

Currently we do not share detailed technical information on the exploitation or a proof-of-concept (PoC) for the vulnerabilities, as this could be misused by malicious actors. We plan to update this blog post with a technical write-up at a later time.

Advisories

• CVE-2026-61897: AccountsService sets only effective UID before launching Ubuntu language helpers, leaving real UID as root and allowing any subsequently spawned shell to regain full root credentials
• CVE-2026-61898: Ubuntu language helper scripts embed unsanitized attacker-controlled input, enabling shell injection via the sed execute flag (/e)

Credits

The vulnerability chain was discovered by Deutsche Telekom’s Red Team during targeted research into local privilege escalation vectors on modern Linux systems.

If you have questions regarding this research or are interested in our security offerings, including Red Team assessments, feel free to contact [loading (JS)…].

Timeline

• 2026-06-23: Initial vulnerability report to Canonical/Ubuntu Security Team.
• 2026-06-24: Acknowledgment of receipt and initial triage.
• 2026-07-13: CVE-2026-61897 and CVE-2026-61898 have been assigned to the issues.
• 2026-07-21: Coordinated responsible disclosure: Canonical releases patches and this blog post is published.