acl before version 2.4.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability that allows local attackers to escalate privileges by replacing a pathname component with a symbolic link between an lstat() check and subsequent symlink-following operations such as stat(), chown(), chmod(), acl_get_file(), and acl_set_file(). Attackers who control a pathname component can redirect file access control list operations to arbitrary files when getfacl, setfacl, or chacl is invoked by a privileged process over an attacker-controlled path, resulting in local privilege escalation.

A time-of-check to time-of-use (TOCTOU) race condition vulnerability was found in `acl`. By replacing a pathname component with a symbolic link between a security check and subsequent file operations, an attacker can redirect file access control list operations. This occurs when privileged processes invoke `getfacl` or `setfacl` over an attacker-controlled path, potentially leading to local privilege escalation.

Red Hat would like to thank Alexander Peslyak <solar@openwall.com> and Andrew Tridgell <tridge60@gmail.com> for reporting this issue. Red Hat Enterprise Linux 10 2026-07-21T00:00:00Z RHSA-2026:42739 acl-0:2.4.0-1.el10_2 Red Hat Enterprise Linux 8 2026-07-22T00:00:00Z RHSA-2026:43420 acl-0:2.4.0-1.el8_10 Red Hat Enterprise Linux 9 2026-07-21T00:00:00Z RHSA-2026:42736 acl-0:2.4.0-1.el9_8 Red Hat Enterprise Linux 9 2026-07-21T00:00:00Z RHSA-2026:42736 acl-0:2.4.0-1.el9_8 Red Hat Discovery 2 2026-07-27T00:00:00Z RHSA-2026:46836 discovery/discovery-ui-rhel9:1784821750 Red Hat Hardened Images 2026-07-01T00:00:00Z RHSA-2026:34351 acl-main-2.4.0-0.1.hum1 Red Hat Update Infrastructure 5 2026-07-23T00:00:00Z RHSA-2026:44481 rhui5/cds-kubernetes-rhel9:1784794818 Red Hat Update Infrastructure 5 2026-07-23T00:00:00Z RHSA-2026:44481 rhui5/cds-rhel9:1784794778 Red Hat Update Infrastructure 5 2026-07-23T00:00:00Z RHSA-2026:44481 rhui5/haproxy-rhel9:1784795112 Red Hat Update Infrastructure 5 2026-07-23T00:00:00Z RHSA-2026:44481 rhui5/installer-rhel9:1784794289 Red Hat Update Infrastructure 5 2026-07-23T00:00:00Z RHSA-2026:44481 rhui5/rhua-rhel9:1784795076 Red Hat Enterprise Linux 6 Fix deferred acl Red Hat Enterprise Linux 7 Fix deferred acl Red Hat OpenShift Container Platform 4 Fix deferred rhcos https://www.cve.org/CVERecord?id=CVE-2026-54370 https://nvd.nist.gov/vuln/detail/CVE-2026-54370