Skip to main content

acl utilities CVE-2026-54370

| EUVDEUVD-2026-40086 HIGH
Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367)
2026-06-29 VulnCheck GHSA-r45p-762r-6pqj
Privilege Escalation Red Hat Suse Acl Acl Project
7.2
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
7.2 HIGH
CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
6.3 MEDIUM

Local-only TOCTOU (AV:L) needing an unprivileged account (PR:L) and a hard-to-win race (AC:H); successful escalation compromises file ACLs/ownership giving high C/I, no direct availability impact.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
SUSE
7.4 HIGH
AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat
6.3 MEDIUM
qualitative

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector
Local
Attack Complexity
High
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

1
Analysis Generated
Jun 29, 2026 - 14:20 vuln.today

DescriptionCVE.org

acl before version 2.4.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability that allows local attackers to escalate privileges by replacing a pathname component with a symbolic link between an lstat() check and subsequent symlink-following operations such as stat(), chown(), chmod(), acl_get_file(), and acl_set_file(). Attackers who control a pathname component can redirect file access control list operations to arbitrary files when getfacl, setfacl, or chacl is invoked by a privileged process over an attacker-controlled path, resulting in local privilege escalation.

AnalysisAI

Local privilege escalation in the Linux acl package (libacl/getfacl/setfacl/chacl) before version 2.4.0 lets an unprivileged local user who controls a component of a pathname win a TOCTOU race, redirecting privileged file-ACL operations to arbitrary files. By swapping a path component for a symlink between the lstat() validation and the follow-on stat()/chown()/chmod()/acl_get_file()/acl_set_file() calls, an attacker can manipulate ownership and ACLs on targets they should not control, yielding root-equivalent escalation. No public exploit identified at time of analysis; the issue was reported by VulnCheck and is fixed upstream.

Technical ContextAI

The acl project provides the user-space ACL tooling (getfacl, setfacl, chacl) and libacl, which are standard on virtually all POSIX/Linux systems for managing POSIX.1e access control lists. The root cause is CWE-367 (Time-of-check Time-of-use race condition): the code performs an lstat() on a path to verify it is not a symlink, then later performs symlink-following operations (stat(), chown(), chmod(), acl_get_file(), acl_set_file()) on the same path. Because the check and the use are not atomic and the operations are not performed on a stable file handle (e.g., via *at() syscalls with O_NOFOLLOW or fd-relative resolution), an attacker who controls an intermediate directory component can replace it with a symlink in the race window, causing the privileged operation to resolve to an attacker-chosen target.

RemediationAI

Vendor-released patch: upgrade to acl 2.4.0 or later, which contains the upstream fix (commits 3589787cd589b34bdd9265936e17190b6d3f17d1 and 24a227d0ab8576612194f8a56c2314389adc74a5 at https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=3589787cd589b34bdd9265936e17190b6d3f17d1); on managed distributions apply the vendor's backported acl package update once available. Until patched, reduce exposure by avoiding running getfacl/setfacl/chacl as root or other privileged users over paths whose parent directories are writable by unprivileged users (side effect: scripted ACL automation over user-controlled trees must be paused or rerouted), and tighten permissions on world- or group-writable directories that privileged ACL operations traverse so attackers cannot insert symlink components (side effect: may break workflows that rely on shared writable directories). Cross-reference the VulnCheck advisory at https://www.vulncheck.com/advisories/acl-toctou-symlink-traversal-via-getfacl-setfacl-chacl for fix confirmation.

More in Acl

View all
CVE-2018-25320 CRITICAL POC
9.3 May 17

ACL Analytics versions 11.x through 13.0.0.579 contain an arbitrary code execution vulnerability that allows attackers t
CVE-2026-54371 HIGH
8.4 Jun 29

Local privilege escalation in the attr package's getfattr and setfattr utilities (versions before 2.6.0) allows an attac
CVE-2026-54369 HIGH
8.4 Jun 29

Local privilege escalation in the Linux acl utilities (libacl) before version 2.4.0 arises because the pathname-based fu

Same weakness CWE-367 – Time-of-check Time-of-use (TOCTOU) Race Condition

View all
CVE-2024-30088 HIGH POC
7.0
CVE-2025-22224 CRITICAL
9.3
CVE-2025-38352 HIGH POC
7.8
CVE-2022-48618 HIGH
7.0
CVE-2023-38146 HIGH POC
8.8
CVE-2025-34027 CRITICAL POC
10.0
CVE-2020-1337 HIGH POC
7.8
CVE-2026-25641 CRITICAL POC
10.0

Same technique Privilege Escalation

View all
CVE-2024-0012 CRITICAL POC
9.3
CVE-2025-47812 CRITICAL POC
10.0
CVE-2013-0422 CRITICAL POC
9.8
CVE-2013-0632 CRITICAL POC
9.8
CVE-2024-9474 MEDIUM POC
6.9
CVE-2017-5689 CRITICAL POC
9.8
CVE-2021-20021 CRITICAL POC
9.8
CVE-2017-12635 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Liberty Linux 10 Fixed
SUSE Liberty Linux 8 Fixed
SUSE Liberty Linux 9 Fixed
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Desktop 15 SP7 Affected

Share

CVE-2026-54370 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy