Bug 2456336 (CVE-2026-32282)

Summary: CVE-2026-32282 golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: aazores, abarbaro, abrianik, akostadi, akoudelk, alcohan, alebedev, alizardo, amasferr, amctagga, anjoseph, anpicker, ansmith, anthomas, aoconnor, asatyam, ataylor, bbrownin, bdettelb, bniver, bparees, chfoley, ckandaga, cmah, crizzo, csutherl, dbruscin, dhanak, diagrawa, dmayorov, doconnor, drosa, dschmidt, dsimansk, dsoumis, dymurray, eaguilar, ebaron, eborisov, eglynn, ehelms, erezende, ewittman, fdeutsch, flucifre, ggainey, ggrzybek, gmeno, gparvin, groman, hasun, ibolton, janstey, jbalunas, jburrell, jcantril, jchui, jclere, jeder, jfula, jhe, jjoyce, jkoehler, jlanda, jlledo, jmatthew, jmontleo, jolong, jowilson, jprabhak, jpretori, jraez, jschluet, juwatts, jwon, kingland, kshier, ktsao, kvanderr, kverlaen, lball, lbragsta, lchilton, lgamliel, lhh, lphiri, manissin, mbenjamin, mbocek, mburns, mgarciac, mhackett, mhulan, mnovotny, mrunge, mwringe, nboldt, ngough, nipatil, nmoumoul, nyancey, oaljalju, ometelka, oramraz, osousa, pahickey, pantinor, parichar, pcreech, peholase, pgaikwad, pjindal, plodge, psrna, ptisnovs, pvasanth, rchan, rfreiman, rgodfrey, rhaigner, rhel-process-autobot, rjohnson, rkubis, rmaucher, rojacob, sabiswas, sakbas, sausingh, sdawley, sfeifer, simaishi, slucidi, smallamp, smcdonal, smullick, sostapov, sseago, stcannon, stirabos, swoodman, syedriko, szappis, tasato, teagle, thason, tmalecek, tsedmik, tzivkovi, vereddy, veshanka, vimartin, vkarehfa, watson-tool-maintainers, wenshen, whayutin, wtam, xdharmai, yguenane
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in the internal/syscall/unix package in the Go standard library. If the target of the `Root.Chmod` function is replaced with a symbolic link during execution, specifically after `Root.Chmod` checks the target but before acting, the `chmod` operation will be performed on the file the symbolic link points to. This issue can bypass directory restrictions and lead to unauthorized permission changes on the filesystem.
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2456942    
Bug Blocks:    

Description OSIDB Bzimport 2026-04-08 02:01:35 UTC
On Linux, if the target of Root.Chmod is replaced with a symlink while the chmod operation is in progress, Chmod can operate on the target of the symlink, even when the target lies outside the root. The Linux fchmodat syscall silently ignores the AT_SYMLINK_NOFOLLOW flag, which Root.Chmod uses to avoid symlink traversal. Root.Chmod checks its target before acting and returns an error if the target is a symlink lying outside the root, so the impact is limited to cases where the target is replaced with a symlink between the check and operation.

Comment 5 errata-xmlrpc 2026-04-23 21:35:48 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:10217 https://access.redhat.com/errata/RHSA-2026:10217

Comment 6 errata-xmlrpc 2026-04-24 02:33:37 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:10219 https://access.redhat.com/errata/RHSA-2026:10219

Comment 7 errata-xmlrpc 2026-04-27 02:09:30 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:10704 https://access.redhat.com/errata/RHSA-2026:10704

Comment 8 errata-xmlrpc 2026-04-29 07:28:06 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:11507 https://access.redhat.com/errata/RHSA-2026:11507

Comment 9 errata-xmlrpc 2026-04-29 08:02:00 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:11514 https://access.redhat.com/errata/RHSA-2026:11514

Comment 10 errata-xmlrpc 2026-04-29 13:03:31 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:11704 https://access.redhat.com/errata/RHSA-2026:11704

Comment 11 errata-xmlrpc 2026-04-29 13:09:41 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:11712 https://access.redhat.com/errata/RHSA-2026:11712

Comment 12 errata-xmlrpc 2026-04-29 13:27:07 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:11711 https://access.redhat.com/errata/RHSA-2026:11711

Comment 13 errata-xmlrpc 2026-04-29 17:50:31 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:11863 https://access.redhat.com/errata/RHSA-2026:11863

Comment 17 errata-xmlrpc 2026-05-06 15:29:35 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:14200 https://access.redhat.com/errata/RHSA-2026:14200

Comment 18 errata-xmlrpc 2026-05-06 21:10:12 UTC
This issue has been addressed in the following products:

  Cryostat 4 on RHEL 9

Via RHSA-2026:14391 https://access.redhat.com/errata/RHSA-2026:14391

Comment 19 errata-xmlrpc 2026-05-11 12:17:59 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:15980 https://access.redhat.com/errata/RHSA-2026:15980

Comment 20 errata-xmlrpc 2026-05-11 16:19:41 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10.0 Extended Update Support

Via RHSA-2026:16024 https://access.redhat.com/errata/RHSA-2026:16024

Comment 21 errata-xmlrpc 2026-05-11 18:31:41 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.6 Extended Update Support

Via RHSA-2026:16021 https://access.redhat.com/errata/RHSA-2026:16021

Comment 22 errata-xmlrpc 2026-05-13 07:59:36 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:16875 https://access.redhat.com/errata/RHSA-2026:16875

Comment 23 errata-xmlrpc 2026-05-13 15:05:54 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:17075 https://access.redhat.com/errata/RHSA-2026:17075

Comment 24 errata-xmlrpc 2026-05-13 15:36:28 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10.0 Extended Update Support

Via RHSA-2026:17084 https://access.redhat.com/errata/RHSA-2026:17084

Comment 25 errata-xmlrpc 2026-05-18 08:56:24 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10.0 Extended Update Support

Via RHSA-2026:18027 https://access.redhat.com/errata/RHSA-2026:18027

Comment 26 errata-xmlrpc 2026-05-18 09:21:17 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10.0 Extended Update Support

Via RHSA-2026:18032 https://access.redhat.com/errata/RHSA-2026:18032

Comment 27 errata-xmlrpc 2026-05-19 16:05:36 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:19132 https://access.redhat.com/errata/RHSA-2026:19132

Comment 28 errata-xmlrpc 2026-05-19 16:06:11 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:19133 https://access.redhat.com/errata/RHSA-2026:19133

Comment 29 errata-xmlrpc 2026-05-19 16:06:49 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:19134 https://access.redhat.com/errata/RHSA-2026:19134

Comment 30 errata-xmlrpc 2026-05-19 16:06:59 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:19136 https://access.redhat.com/errata/RHSA-2026:19136

Comment 31 errata-xmlrpc 2026-05-19 16:07:33 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:19135 https://access.redhat.com/errata/RHSA-2026:19135

Comment 32 errata-xmlrpc 2026-05-19 16:09:07 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:19144 https://access.redhat.com/errata/RHSA-2026:19144

Comment 33 errata-xmlrpc 2026-05-19 16:10:08 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:19156 https://access.redhat.com/errata/RHSA-2026:19156

Comment 34 errata-xmlrpc 2026-05-19 21:37:27 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:19350 https://access.redhat.com/errata/RHSA-2026:19350

Comment 35 errata-xmlrpc 2026-05-19 21:38:24 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:19351 https://access.redhat.com/errata/RHSA-2026:19351

Comment 36 errata-xmlrpc 2026-05-19 21:38:33 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:19352 https://access.redhat.com/errata/RHSA-2026:19352

Comment 37 errata-xmlrpc 2026-05-19 21:39:16 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:19353 https://access.redhat.com/errata/RHSA-2026:19353

Comment 38 errata-xmlrpc 2026-05-19 21:41:17 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:19369 https://access.redhat.com/errata/RHSA-2026:19369

Comment 39 errata-xmlrpc 2026-05-20 08:28:38 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10.0 Extended Update Support

Via RHSA-2026:19550 https://access.redhat.com/errata/RHSA-2026:19550

Comment 40 errata-xmlrpc 2026-05-20 16:19:17 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10.0 Extended Update Support

Via RHSA-2026:19714 https://access.redhat.com/errata/RHSA-2026:19714

Comment 41 errata-xmlrpc 2026-05-20 16:20:50 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10.0 Extended Update Support

Via RHSA-2026:19715 https://access.redhat.com/errata/RHSA-2026:19715

Comment 42 errata-xmlrpc 2026-05-20 16:41:08 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10.0 Extended Update Support

Via RHSA-2026:19719 https://access.redhat.com/errata/RHSA-2026:19719

Comment 43 errata-xmlrpc 2026-05-20 16:48:18 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.4 Extended Update Support

Via RHSA-2026:19721 https://access.redhat.com/errata/RHSA-2026:19721

Comment 44 errata-xmlrpc 2026-05-20 16:53:33 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.6 Extended Update Support

Via RHSA-2026:19720 https://access.redhat.com/errata/RHSA-2026:19720

Comment 45 errata-xmlrpc 2026-05-20 16:56:06 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.6 Extended Update Support

Via RHSA-2026:19722 https://access.redhat.com/errata/RHSA-2026:19722

Comment 46 errata-xmlrpc 2026-05-20 17:22:58 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10.0 Extended Update Support

Via RHSA-2026:19750 https://access.redhat.com/errata/RHSA-2026:19750

Comment 47 errata-xmlrpc 2026-05-20 23:53:09 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.6 Extended Update Support

Via RHSA-2026:19839 https://access.redhat.com/errata/RHSA-2026:19839

Comment 48 errata-xmlrpc 2026-05-26 03:42:08 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.6 Extended Update Support

Via RHSA-2026:20556 https://access.redhat.com/errata/RHSA-2026:20556