Red Hat Security Advisory

RHSA-2026:42736

acl security update

Released 2026-07-21 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream (v. 9) libacl-devel-2.4.0-1.el9_8
Red Hat Enterprise Linux BaseOS (v. 9) acl-2.4.0-1.el9_8, libacl-2.4.0-1.el9_8

Fixes 2 records

TI-2026-39261 CVE-2026-54369 · GHSA-53ch-pxc8-6g72

acl < 2.4.0 Symlink Traversal Privilege Escalation via libacl Functions

LOW 37

acl before version 2.4.0 contains a symlink traversal vulnerability in the libacl pathname-based functions acl_get_file(), acl_set_file(), acl_extended_file(), and acl_delete_def_file() that allows local attackers to esc…

CVSS 4.0HIGH 8.4 Local Low privileges No interaction EPSS 0.00153 Published 2026-06-29 Partial fix · 2.4.0 CWE-59

TI-2026-39262 CVE-2026-54370 · GHSA-r45p-762r-6pqj

acl < 2.4.0 TOCTOU Symlink Traversal via getfacl/setfacl/chacl

LOW 32

acl before version 2.4.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability that allows local attackers to escalate privileges by replacing a pathname component with a symbolic link between an…

CVSS 4.0HIGH 7.2 Local Low privileges No interaction EPSS 0.00088 Published 2026-06-29 Partial fix · 2.4.0 CWE-367