systemd-tmpfiles CVE-2026-16552

Exploitation requires a local, authenticated session as a low-privileged user (PR:L per CVSS vector - no unauthenticated remote vector exists). The critical and non-default prerequisite is the presence of a tmpfiles.d configuration entry that writes to a file path where the attacker has write access to at least one intermediate directory component, enabling symlink placement before path resolution completes. Standard RHEL system tmpfiles.d configurations typically target root-owned paths with no user-writable ancestors, making exploitation unlikely on unmodified, default deployments. Attack complexity is rated High (AC:H) specifically because this configuration dependency must exist. Additional limiting factors: the attacker cannot control the content written to the redirected file - only where it lands; the attack requires timing the symlink placement prior to systemd-tmpfiles execution; and the vulnerability is scoped to RHEL 7/8/9/10, Red Hat Hardened Images, and OpenShift CP4 as reported by Red Hat, with the upstream fix not yet confirmed as released.

The CVSS 3.1 score of 6.3 (AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H) is consistent with the described attack: local access with low privileges is required, and the High attack complexity reflects the prerequisite that a specific tmpfiles.d configuration must exist where a user-influenceable path is targeted by a privileged write. No EPSS data was supplied; absent that signal, the constrained exploitation path suggests low opportunistic exploitation probability. There is no CISA KEV listing and no known public proof-of-concept at time of analysis, further reducing the immediate threat level. The I:H rating is well-justified - redirecting a privileged write to a sensitive system file (e.g., /etc/sudoers.d/ or /etc/cron.d/) would constitute a meaningful integrity violation. The A:H rating is less directly supported by the description, which explicitly states the highest threat is to integrity; availability impact likely applies only in scenarios where overwriting a critical file causes service failure, and may be overstated for typical exploits. This vulnerability represents a real but targeted local privilege escalation risk rather than a broadly exploitable critical threat.

A local user with a shell account on a RHEL system identifies a tmpfiles.d entry that writes to a file whose parent directory contains an intermediate component the attacker has write access to. Before the next systemd-tmpfiles execution - typically at system startup or via a systemd timer - the attacker replaces the writable intermediate directory with a symbolic link pointing toward a sensitive target such as /etc/cron.d/ or /etc/sudoers.d/. When systemd-tmpfiles processes the configuration entry, the safety check in chase.c fails to detect the attacker-placed symlink, causing the privileged write to land on the symlink target rather than the intended path, overwriting it with the configuration-defined content.