An attacker who has already compromised the 'mysql' OS user account can manipulate the MySQL persisted configuration file (mysqld-auto.cnf) to point the 'plugin_dir' to a directory they control, such as /var/lib/mysql. By configuring early plugin loading options within this file, the attacker forces the 'mysqld' process to load a malicious shared object. When an administrator subsequently executes the documented Leapp upgrade workflow, the 'mysqld' process executes the malicious code as root within an unconfined SELinux domain, granting the attacker full system control. This vulnerability highlights a critical failure in the privilege transition during the system upgrade lifecycle.

Attack Chain

1. Attacker gains initial access to the system with the identity of the 'mysql' service user.
2. Attacker creates a malicious shared object file (.so) and places it within /var/lib/mysql.
3. Attacker modifies the persisted configuration file /var/lib/mysql/mysqld-auto.cnf.
4. Attacker updates the 'plugin_dir' configuration entry in mysqld-auto.cnf to /var/lib/mysql.
5. Attacker adds configuration options such as 'early_plugin_load' to point to the malicious shared object.
6. An administrator runs the RHEL 9 to RHEL 10 Leapp preupgrade or upgrade workflow.
7. The 'scan_mysql' actor invokes 'mysqld' as root, executing the malicious shared object during the validation phase.
8. Attacker gains root access with a full capability set, resulting in persistent system compromise.

Impact

Successful exploitation of CVE-2026-75092 allows an attacker to transition from the limited 'mysql' service account to full root privileges on a RHEL system. This vulnerability impacts systems undergoing an upgrade from RHEL 9 to RHEL 10. If successful, the attacker can install backdoors, exfiltrate sensitive data, or disable security controls, effectively compromising the integrity and confidentiality of the host operating system.

Recommendation

Prioritized actions for detection and mitigation teams:

• Patch the leapp-upgrade-el9toel10 package to the version provided by Red Hat that addresses CVE-2026-75092.
• Audit existing configuration files in /var/lib/mysql/ for suspicious 'plugin_dir' or 'early_plugin_load' directives that reference non-standard paths.
• Monitor process creation logs for 'mysqld' executions where the parent process is associated with the 'leapp' upgrade framework.
• Ensure that the 'mysql' service user has no writable access to directories other than intended data directories to prevent the placement of malicious shared objects.