CVE-2026-54370
Fixed in a distro release EPSS <1%CVSS 6.3
acl before version 2.4.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability that allows local attackers to escalate privileges by replacing a pathname component with a symbolic link between an lstat() check and subsequent symlink-following operations such as stat(), chown(), chmod(), acl_get_file(), and acl_set_file(). Attackers who control a pathname component can redirect file access control list operations to arbitrary files when getfacl, setfacl, or chacl is invoked by a privileged process over an attacker-controlled path, resulting in local privilege escalation.
Products: acl project acl
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux 10 | acl | 2.4.0-1.el10_2 |
| AlmaLinux 10 | libacl | 2.4.0-1.el10_2 |
| AlmaLinux 10 | libacl-devel | 2.4.0-1.el10_2 |
| AlmaLinux 8 | acl | 2.4.0-1.el8_10 |
| AlmaLinux 8 | libacl | 2.4.0-1.el8_10 |
| AlmaLinux 8 | libacl-devel | 2.4.0-1.el8_10 |
| AlmaLinux 9 | acl | 2.4.0-1.el9_8 |
| AlmaLinux 9 | libacl | 2.4.0-1.el9_8 |
| AlmaLinux 9 | libacl-devel | 2.4.0-1.el9_8 |
| Amazon Linux 2023 | acl | 2.4.0-1.amzn2023.0.1 |
| Amazon Linux 2023 | libacl | 2.4.0-1.amzn2023.0.1 |
| Amazon Linux 2023 | libacl-devel | 2.4.0-1.amzn2023.0.1 |
| Debian 12 | acl | no fix |
| Debian 13 | acl | no fix |
| Debian 14 | acl | 2.4.0-1 |
| Red Hat Enterprise Linux 10.2 | acl | 0:2.4.0-1.el10_2 |
| Red Hat Enterprise Linux 10.2 | acl-debuginfo | 0:2.4.0-1.el10_2 |
| Red Hat Enterprise Linux 10.2 | acl-debugsource | 0:2.4.0-1.el10_2 |
| Red Hat Enterprise Linux 10.2 | libacl | 0:2.4.0-1.el10_2 |
| Red Hat Enterprise Linux 10.2 | libacl-debuginfo | 0:2.4.0-1.el10_2 |
| Red Hat Enterprise Linux 10.2 | libacl-devel | 0:2.4.0-1.el10_2 |
| Red Hat Enterprise Linux 8 | acl | 0:2.4.0-1.el8_10 |
| Red Hat Enterprise Linux 8 | acl-debuginfo | 0:2.4.0-1.el8_10 |
| Red Hat Enterprise Linux 8 | acl-debugsource | 0:2.4.0-1.el8_10 |
| Red Hat Enterprise Linux 8 | libacl | 0:2.4.0-1.el8_10 |
| Red Hat Enterprise Linux 8 | libacl-debuginfo | 0:2.4.0-1.el8_10 |
| Red Hat Enterprise Linux 8 | libacl-devel | 0:2.4.0-1.el8_10 |
| Red Hat Enterprise Linux 9 | acl | 0:2.4.0-1.el9_8 |
| Red Hat Enterprise Linux 9 | acl-debuginfo | 0:2.4.0-1.el9_8 |
| Red Hat Enterprise Linux 9 | acl-debugsource | 0:2.4.0-1.el9_8 |
| Red Hat Enterprise Linux 9 | libacl | 0:2.4.0-1.el9_8 |
| Red Hat Enterprise Linux 9 | libacl-debuginfo | 0:2.4.0-1.el9_8 |
| Red Hat Enterprise Linux 9 | libacl-devel | 0:2.4.0-1.el9_8 |
| Red Hat hummingbird 1 | acl | 0:2.4.0-0.1.hum1 |
| Red Hat hummingbird 1 | libacl | 0:2.4.0-0.1.hum1 |
| Red Hat hummingbird 1 | libacl-devel | 0:2.4.0-0.1.hum1 |
| Rocky Linux 10 | acl | 0:2.4.0-1.el10_2 |
| Rocky Linux 8 | acl | 0:2.4.0-1.el8_10 |
| Rocky Linux 9 | acl | 0:2.4.0-1.el9_8 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS | acl | 2.4.0-150000.4.6.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS | attr | 2.6.0-150000.4.3.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS | acl | 2.4.0-150000.4.6.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS | attr | 2.6.0-150000.4.3.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS | acl | 2.4.0-150000.4.6.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS | attr | 2.6.0-150000.4.3.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS | acl | 2.4.0-150000.4.6.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS | attr | 2.6.0-150000.4.3.1 |
| SUSE Linux Enterprise Micro 5.3 | acl | 2.4.0-150000.4.6.1 |
| SUSE Linux Enterprise Micro 5.3 | attr | 2.6.0-150000.4.3.1 |
| SUSE Linux Enterprise Micro 5.4 | acl | 2.4.0-150000.4.6.1 |
| SUSE Linux Enterprise Micro 5.4 | attr | 2.6.0-150000.4.3.1 |
| SUSE Linux Enterprise Micro 5.5 | acl | 2.4.0-150000.4.6.1 |
| SUSE Linux Enterprise Micro 5.5 | attr | 2.6.0-150000.4.3.1 |
| SUSE Linux Enterprise Module for Basesystem 15 SP7 | acl | 2.4.0-150000.4.6.1 |
| SUSE Linux Enterprise Module for Basesystem 15 SP7 | attr | 2.6.0-150000.4.3.1 |
| SUSE Linux Enterprise Server 15 SP4-LTSS | acl | 2.4.0-150000.4.6.1 |
| SUSE Linux Enterprise Server 15 SP4-LTSS | attr | 2.6.0-150000.4.3.1 |
| SUSE Linux Enterprise Server 15 SP5-LTSS | acl | 2.4.0-150000.4.6.1 |
| SUSE Linux Enterprise Server 15 SP5-LTSS | attr | 2.6.0-150000.4.3.1 |
| SUSE Linux Enterprise Server 15 SP6-LTSS | acl | 2.4.0-150000.4.6.1 |
| SUSE Linux Enterprise Server 15 SP6-LTSS | attr | 2.6.0-150000.4.3.1 |
| SUSE Linux Enterprise Server 16.0 | acl | 2.4.0-160000.1.1 |
| SUSE Linux Enterprise Server 16.0 | attr | 2.6.0-160000.1.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP4 | acl | 2.4.0-150000.4.6.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP4 | attr | 2.6.0-150000.4.3.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP5 | acl | 2.4.0-150000.4.6.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP5 | attr | 2.6.0-150000.4.3.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP6 | acl | 2.4.0-150000.4.6.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP6 | attr | 2.6.0-150000.4.3.1 |
| SUSE Linux Enterprise Server for SAP applications 16.0 | acl | 2.4.0-160000.1.1 |
| SUSE Linux Enterprise Server for SAP applications 16.0 | attr | 2.6.0-160000.1.1 |
| SUSE Linux Micro 6.2 | acl | 2.4.0-160000.1.1 |
| SUSE Linux Micro 6.2 | attr | 2.6.0-160000.1.1 |
| Ubuntu 14.04 LTS | acl | no fix |
| Ubuntu 16.04 LTS | acl | no fix |
| Ubuntu 18.04 LTS | acl | no fix |
| Ubuntu 20.04 LTS | acl | no fix |
| Ubuntu 22.04 LTS | acl | no fix |
| Ubuntu 24.04 LTS | acl | no fix |
| Ubuntu 25.10 | acl | no fix |
| Ubuntu 26.04 LTS | acl | no fix |
| openSUSE Leap 16.0 | acl | 2.4.0-160000.1.1 |
| openSUSE Leap 16.0 | attr | 2.6.0-160000.1.1 |
| openSUSE Tumbleweed | acl | 2.4.0-1.1 |