Skip to main content

acl utilities CVE-2026-54370

| EUVDEUVD-2026-40086 HIGH
Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367)
2026-06-29 VulnCheck GHSA-r45p-762r-6pqj
Privilege Escalation Acl Acl Project
7.2
CVSS 4.0 · Vendor: VulnCheck
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Gain local low-priv access
  2. Delivery
    Create attacker-controlled path component
  3. Exploit
    Wait for privileged getfacl/setfacl/chacl run
  4. Execution
    Swap component to symlink mid-race
  5. Persist
    Redirect ACL/ownership to target file
  6. Impact
    Escalate to root

Vulnerability Assessment

Weakness
CWE
CWE-367
ASVS 5.0
V15 - Secure Coding and Architecture TOCTOU prevention
Exploitation Conditions

Exploitation requires local access with low privileges (PR:L) and the ability to control at least one component of a pathname (e.g., a writable parent directory) that a privileged process subsequently passes to getfacl, setfacl, or chacl. The critical prerequisite is that a privileged (typically root) process actually invokes one of these acl operations over the attacker-influenced path - without such a privileged invocation there is no escalation. Exploitation is limited by high attack complexity (AC:H): the attacker must win a narrow race window between the lstat() check and the symlink-following operation, often requiring many attempts; it is also constrained to local, authenticated users and to versions of acl before 2.4.0.
Impact

The CVSS 4.0 vector (AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N) scores 7.2 (High) and is internally consistent with the description: exploitation is local (AV:L), requires existing low-level access (PR:L), needs no user interaction (UI:N), and is high-complexity (AC:H) because it depends on winning a non-deterministic race window. Confidentiality and integrity impact are high (the attacker can read/alter ACLs and ownership of arbitrary files leading to root), with no direct availability impact (VA:N). There is no CISA KEV listing and no public POC referenced, so this is not evidence of active exploitation - risk is driven by the ubiquity of the affected package rather than by in-the-wild activity. The practical bar is meaningful: an attacker needs a privileged process to invoke getfacl/setfacl/chacl over an attacker-controlled path, plus the ability to win the race. EPSS is not provided in the input, so probabilistic exploitation likelihood cannot be quantified here. Net: a real, defensible-priority local-privesc bug for multi-user and shared hosts, but not a remote or mass-exploitation emergency.
Exploit ScenarioDerived

On a shared Linux host, an unprivileged user creates a directory tree they control and waits for (or triggers) a root cron job or admin script that runs setfacl/chown over that path. They repeatedly swap an intermediate path component for a symlink to /etc or a SUID binary, and on a successful race the privileged ACL/ownership change is applied to the attacker's chosen target, granting them write access and root escalation. No public POC is referenced, but the technique (symlink race against TOCTOU) is well understood and reliably scriptable.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jun 29, 2026

Local privilege escalation in the Linux acl package (libacl/getfacl/setfacl/chacl) before version 2.4.0 lets an unprivileged local user who controls a component of a pathname win a TOCTOU race, redirecting privileged file-ACL operations to arbitrary files. By swapping a path component for a symlink between the lstat() validation and the follow-on stat()/chown()/chmod()/acl_get_file()/acl_set_file() calls, an attacker can manipulate ownership and ACLs on targets they should not control, yielding root-equivalent escalation. No public exploit identified at time of analysis; the issue was reported by VulnCheck and is fixed upstream.

RemediationAI

Vendor-released patch: upgrade to acl 2.4.0 or later, which contains the upstream fix (commits 3589787cd589b34bdd9265936e17190b6d3f17d1 and 24a227d0ab8576612194f8a56c2314389adc74a5 at https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=3589787cd589b34bdd9265936e17190b6d3f17d1); on managed distributions apply the vendor's backported acl package update once available. Until patched, reduce exposure by avoiding running getfacl/setfacl/chacl as root or other privileged users over paths whose parent directories are writable by unprivileged users (side effect: scripted ACL automation over user-controlled trees must be paused or rerouted), and tighten permissions on world- or group-writable directories that privileged ACL operations traverse so attackers cannot insert symlink components (side effect: may break workflows that rely on shared writable directories). Cross-reference the VulnCheck advisory at https://www.vulncheck.com/advisories/acl-toctou-symlink-traversal-via-getfacl-setfacl-chacl for fix confirmation.

Affected VersionsENISA

acl 0 <2.4.0

Affected Packages

euvd acl fix: 2.4.0

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The acl project provides the user-space ACL tooling (getfacl, setfacl, chacl) and libacl, which are standard on virtually all POSIX/Linux systems for managing POSIX.1e access control lists. The root cause is CWE-367 (Time-of-check Time-of-use race condition): the code performs an lstat() on a path to verify it is not a symlink, then later performs symlink-following operations (stat(), chown(), chmod(), acl_get_file(), acl_set_file()) on the same path. Because the check and the use are not atomic and the operations are not performed on a stable file handle (e.g., via *at() syscalls with O_NOFOLLOW or fd-relative resolution), an attacker who controls an intermediate directory component can replace it with a symlink in the race window, causing the privileged operation to resolve to an attacker-chosen target.

Know when Acl gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (VulnCheck) PRIMARY 7.2 HIGH
CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
vuln.today AI 6.3 MEDIUM

Local-only TOCTOU (AV:L) needing an unprivileged account (PR:L) and a hard-to-win race (AC:H); successful escalation compromises file ACLs/ownership giving high C/I, no direct availability impact.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
SUSE 7.4 HIGH
AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat 6.3 MEDIUM

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector
Local
Attack Complexity
High
Attack Requirements
None
Privileges Required
Low
User Interaction
None
Vulnerable system: Confidentiality
High
Vulnerable system: Integrity
High
Vulnerable system: Availability
None
Subsequent system: Confidentiality
None
Subsequent system: Integrity
None
Subsequent system: Availability
None

DescriptionCVE.org

acl before version 2.4.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability that allows local attackers to escalate privileges by replacing a pathname component with a symbolic link between an lstat() check and subsequent symlink-following operations such as stat(), chown(), chmod(), acl_get_file(), and acl_set_file(). Attackers who control a pathname component can redirect file access control list operations to arbitrary files when getfacl, setfacl, or chacl is invoked by a privileged process over an attacker-controlled path, resulting in local privilege escalation.

Executive ViewAI

Why It Matters

A race condition in the Linux acl package (versions before 2.4.0) enables local privilege escalation, allowing unprivileged users to manipulate file ownership and access controls to gain root-equivalent permissions. This affects any organization running Linux systems with multiple local users, potentially compromising data access controls and system integrity across infrastructure.

Business Impact: High
Compensating Controls

Vendor-released patch: acl version 2.4.0. Upgrade all vulnerable systems to this version or later.

Threat Intelligence Overview

EPSS Score
0.1%
Top 99% exploitable
Prevalence
Ubiquitous
core ACL tooling and libacl present on nearly all Linux systems
Data Quality
8 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment Vendor CIRCL VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.1%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Small
Automatable
No
Human Impact
High
Technical Impact
Total

Priority Score

36
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +36
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Privilege Escalation HIGH

Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.

More in Acl

View all
CVE-2018-25320 CRITICAL POC
9.3 May 17

ACL Analytics versions 11.x through 13.0.0.579 contain an arbitrary code execution vulnerability that allows attackers t
CVE-2026-54371 HIGH
8.4 Jun 29

Local privilege escalation in the attr package's getfattr and setfattr utilities (versions before 2.6.0) allows an attac
CVE-2026-54369 HIGH
8.4 Jun 29

Local privilege escalation in the Linux acl utilities (libacl) before version 2.4.0 arises because the pathname-based fu

Same weakness CWE-367 – Time-of-check Time-of-use (TOCTOU) Race Condition

View all
CVE-2024-30088 HIGH POC
7.0
CVE-2025-22224 CRITICAL
9.3
CVE-2025-38352 HIGH POC
7.8
CVE-2023-35311 HIGH
8.8
CVE-2022-48618 HIGH
7.0
CVE-2023-38146 HIGH POC
8.8
CVE-2025-34027 CRITICAL POC
10.0
CVE-2020-1337 HIGH POC
7.8

Same technique Privilege Escalation

View all
CVE-2024-0012 CRITICAL POC
9.3
CVE-2025-47812 CRITICAL POC
10.0
CVE-2013-0422 CRITICAL POC
9.8
CVE-2013-0632 CRITICAL POC
9.8
CVE-2024-9474 MEDIUM POC
6.9
CVE-2017-5689 CRITICAL POC
9.8
CVE-2021-20021 CRITICAL POC
9.8
CVE-2017-12635 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Liberty Linux 10 Fixed
SUSE Liberty Linux 8 Fixed
SUSE Liberty Linux 9 Fixed
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Desktop 15 SP7 Affected

References

Advisories & patches
PATCH https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=3589787cd589b34bdd9265936e17190b6d3f17d1 ADVISORY https://access.redhat.com/errata/RHSA-2026:34351 ADVISORY https://access.redhat.com/errata/RHSA-2026:42736 ADVISORY https://access.redhat.com/errata/RHSA-2026:42739 ADVISORY https://access.redhat.com/errata/RHSA-2026:43420 ADVISORY https://access.redhat.com/errata/RHSA-2026:44481 ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-54370 ADVISORY https://vuldb.com/vuln/374620 REF https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=24a227d0ab8576612194f8a56c2314389adc74a5 REF https://www.vulncheck.com/advisories/acl-toctou-symlink-traversal-via-getfacl-setfacl-chacl

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy