Bug 2490277 (CVE-2026-54369)

Summary:	CVE-2026-54369 acl: Symlink traversal privilege escalation via libacl functions
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	akhatavk, aos-team-art-private, asdas, dpaolell, jdelft, jupierce, lgarciaa, mbiarnes, ppalepu, ppostler, prdhamdh, rhel-process-autobot, security-response-team, sghai, sidsharm, suppawar, vlaad, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in the `acl` package, specifically within its `libacl` pathname-based functions. A local attacker could exploit this vulnerability by using a symbolic link to replace a pathname component. This could allow the attacker to redirect access control list (ACL) read or write operations to arbitrary files or directories, leading to unauthorized manipulation of ACLs and ultimately local privilege escalation.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2494174
Bug Blocks:
Deadline:	2026-06-29

Description OSIDB Bzimport 2026-06-18 10:53:34 UTC

acl before version 2.4.0 contains a symlink traversal vulnerability in the libacl pathname-based functions acl_get_file(), acl_set_file(), acl_extended_file(), and acl_delete_def_file() that allows local attackers to escalate privileges by replacing any pathname component with a symbolic link. Attackers who control any component of a pathname processed by a privileged caller can redirect ACL read or write operations to arbitrary files or directories, enabling unauthorized manipulation of access control lists and local privilege escalation.

Comment 2 errata-xmlrpc 2026-07-21 15:03:29 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:42736 https://access.redhat.com/errata/RHSA-2026:42736

Comment 3 errata-xmlrpc 2026-07-21 15:15:01 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:42739 https://access.redhat.com/errata/RHSA-2026:42739

Comment 4 errata-xmlrpc 2026-07-22 10:20:26 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:43420 https://access.redhat.com/errata/RHSA-2026:43420

Comment 7 errata-xmlrpc 2026-08-18 12:25:32 UTC

This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.22

Via RHSA-2026:54769 https://access.redhat.com/errata/RHSA-2026:54769

Comment 8 errata-xmlrpc 2026-09-08 04:27:36 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10.0 Extended Update Support

Via RHSA-2026:64805 https://access.redhat.com/errata/RHSA-2026:64805

Comment 9 Jon Orris 2026-09-14 13:37:53 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.6 Extended Update Support

Via RHSA-2026:67140 https://access.redhat.com/errata/RHSA-2026:67140

Comment 10 Jon Orris 2026-09-14 13:38:11 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions

Via RHSA-2026:67142 https://access.redhat.com/errata/RHSA-2026:67142

Comment 11 Jon Orris 2026-09-14 13:40:33 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions

Via RHSA-2026:67144 https://access.redhat.com/errata/RHSA-2026:67144