Vulnerability · Published Jun 29, 2026 · Assigned by VulnCheck
CVE-2026-54370acl < 2.4.0 TOCTOU Symlink Traversal via getfacl/setfacl/chacl
Medium 6.3
In plain English
A medium-severity security flaw in acl from acl project. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 0% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
acl before version 2.4.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability that allows local attackers to escalate privileges by replacing a pathname component with a symbolic link between an lstat() check and subsequent symlink-following operations such as stat(), chown(), chmod(), acl_get_file(), and acl_set_file(). Attackers who control a pathname component can redirect file access control list operations to arbitrary files when getfacl, setfacl, or chacl is invoked by a privileged process over an attacker-controlled path, resulting in local privilege escalation.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:10 | acl | 2.4.0-1.el10_2 | ALSA-2026:42739 |
| AlmaLinux:8 | acl | 2.4.0-1.el8_10 | ALSA-2026:43420 |
| AlmaLinux:9 | acl | 2.4.0-1.el9_8 | ALSA-2026:42736 |
| AlmaLinux:10 | libacl | 2.4.0-1.el10_2 | ALSA-2026:42739 |
| AlmaLinux:8 | libacl | 2.4.0-1.el8_10 | ALSA-2026:43420 |
| AlmaLinux:9 | libacl | 2.4.0-1.el9_8 | ALSA-2026:42736 |
| AlmaLinux:10 | libacl-devel | 2.4.0-1.el10_2 | ALSA-2026:42739 |
| AlmaLinux:8 | libacl-devel | 2.4.0-1.el8_10 | ALSA-2026:43420 |
| AlmaLinux:9 | libacl-devel | 2.4.0-1.el9_8 | ALSA-2026:42736 |
| Debian:12 | acl | no fix listed | DEBIAN-CVE-2026-54370 |
| Debian:13 | acl | no fix listed | DEBIAN-CVE-2026-54370 |
| Debian:14 | acl | 2.4.0-1 | DEBIAN-CVE-2026-54370 |
| Rocky Linux:10 | acl | 0:2.4.0-1.el10_2 | RLSA-2026:42739 |
| Rocky Linux:8 | acl | 0:2.4.0-1.el8_10 | RLSA-2026:43420 |
| Rocky Linux:9 | acl | 0:2.4.0-1.el9_8 | RLSA-2026:42736 |
| Ubuntu:22.04:LTS | acl | no fix listed | UBUNTU-CVE-2026-54370 |
| Ubuntu:24.04:LTS | acl | no fix listed | UBUNTU-CVE-2026-54370 |
| Ubuntu:25.10 | acl | no fix listed | UBUNTU-CVE-2026-54370 |
| Ubuntu:26.04:LTS | acl | no fix listed | UBUNTU-CVE-2026-54370 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| acl project | acl | 0 – before 2.4.0 |
Weakness: CWE-367 · Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
References
- https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=3589787cd589b34bdd9265936e17190b6d3f17d1 patch
- https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=24a227d0ab8576612194f8a56c2314389adc74a5 issue-tracking
- https://www.vulncheck.com/advisories/acl-toctou-symlink-traversal-via-getfacl-setfacl-chacl third-party-advisory