Red Hat EUVD-2026-20012

The vulnerability resides in Go's internal/syscall/unix package, specifically the Root.Chmod function used for privilege-separated file operations. Root.Chmod is designed to enforce a root filesystem boundary by checking whether the target is a symlink pointing outside the root before performing the chmod operation. However, the underlying Linux fchmoat(2) syscall silently ignores the AT_SYMLINK_NOFOLLOW flag, which is intended to prevent symlink traversal. This creates a classic time-of-check-time-of-use (TOCTOU) race condition: an attacker with high privileges can replace the target file with a symlink after the check passes but before the operation executes, causing fchmoat to follow the symlink and modify files outside the root boundary. The CWE classification indicates this is a race condition vulnerability (CWE-367 or similar temporal logic flaw).