Privilege escalation via cap_set_file path race

Privilege escalation in libcap before 2.78 allows local users to alter file capabilities on unintended executables via a path race. In cap_set_file() in cap_file.c, libcap checks the pathname with lstat() but later calls setxattr() or removexattr() on the same path, so a writable parent directory lets an attacker swap in a symlink or different file with renameat2(RENAME_EXCHANGE) between check and use. Exploitation requires local access and write permission in the target file's parent directory while a privileged caller such as setcap or container tooling updates capabilities on an attacker-influenced path, enabling capability injection into an attacker-controlled executable or capability stripping from another file.