EUVD-2026-47736
GHSA-h639-9h3v-cf49
Severity by source
AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H
Local vector and low privileges match the description; high complexity reflects the non-default tmpfiles.d configuration prerequisite; no confidentiality impact since content is config-determined.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
2DescriptionCVE.org
A flaw was found in systemd-tmpfiles. When processing a tmpfiles.d configuration entry that writes to a file, systemd-tmpfiles can follow a symbolic link placed by an unprivileged local user, and an existing safety check does not detect this specific case because it always treats transitions away from the root user as safe. On systems where a tmpfiles.d configuration targets a path an unprivileged user can influence, this could allow that user to redirect a privileged systemd-tmpfiles write to a file of their choosing, though the content written remains determined by the existing configuration rather than by the unprivileged user. The highest threat from this vulnerability is to integrity.
AnalysisAI
Symlink-following vulnerability (CWE-59) in systemd-tmpfiles allows a local, low-privileged user to redirect privileged file write operations to an attacker-controlled path on affected Red Hat Enterprise Linux systems. The flaw resides in the path resolution logic within chase.c, where a safety check incorrectly treats all transitions away from the root user as inherently safe - failing to detect attacker-placed symlinks at tmpfiles.d target path components. Exploitation is constrained by high attack complexity requiring a specific non-default tmpfiles.d configuration, and no public exploit code or CISA KEV listing has been identified at time of analysis.
Technical ContextAI
systemd-tmpfiles is the systemd component responsible for creating, deleting, and managing temporary files and directories according to configuration files in /usr/lib/tmpfiles.d/ and /etc/tmpfiles.d/. The root cause is CWE-59 (Improper Link Resolution Before File Access, 'link following'). The upstream source references provided point directly to src/basic/chase.c and src/tmpfiles/tmpfiles.c in the systemd/systemd GitHub repository: the chase.c path-resolution routine contains a safety check evaluating ownership transitions during symlink traversal, but it incorrectly assumes any transition away from root ownership is safe. This breaks when an unprivileged user controls an intermediate directory component in the resolved path, enabling substitution of a symlink before systemd-tmpfiles finalizes the write target. Crucially, the attacker cannot control the data written - only the destination file - since content is determined entirely by the pre-existing tmpfiles.d configuration entry. Affected CPEs span Red Hat Enterprise Linux 7, 8, 9, and 10, Red Hat Hardened Images, and Red Hat OpenShift Container Platform 4.
RemediationAI
Apply Red Hat errata for the systemd package across affected RHEL 7, 8, 9, and 10 systems as they become available, tracked at https://access.redhat.com/security/cve/CVE-2026-16552 and https://bugzilla.redhat.com/show_bug.cgi?id=2506073. An exact patched version is not independently confirmed from current data - monitor these advisories directly. As a compensating control, audit all files in /usr/lib/tmpfiles.d/ and /etc/tmpfiles.d/ for entries that write to paths where unprivileged users have write access to any intermediate directory component; restrict or remove such entries where operationally possible, though this may affect legitimate system initialization. Hardening intermediate directory permissions with chmod to remove unprivileged write access on parent paths reduces the symlink substitution window, at the trade-off of potentially breaking user-writable directory workflows. Red Hat OpenShift Container Platform 4 deployments should track updated Red Hat Hardened Images and apply container image updates when released.
More in Red Hat Enterprise Linux 10
View allHeap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash
Remote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h
Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
Authentication bypass in 389 Directory Server (shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) lets remo
Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter
Unauthenticated privilege escalation in FreeIPA (Red Hat Identity Management) allows a remote attacker to gain genuine a
Remote code execution in libarchive on 32-bit systems allows unauthenticated attackers to execute arbitrary code via spe
HTTP request smuggling in Undertow (the embedded web server underpinning JBoss EAP, Red Hat Data Grid, and Apache Camel
HTTP request smuggling in Red Hat Undertow allows remote unauthenticated attackers to bypass front-end security controls
Out-of-bounds read in the GnuTLS DTLS handshake reassembly logic lets remote unauthenticated attackers trigger an intege
HTTP request smuggling in Undertow allows remote unauthenticated attackers to send `\r\r\r` as a header block terminator
Local privilege escalation in Performance Co-Pilot (PCP) on Red Hat Enterprise Linux 6 through 10 and OpenShift Containe
Same weakness CWE-59 – Improper Link Resolution Before File Access
View allSame technique Information Disclosure
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today