Red Hat Security Advisory

RHSA-2026:71656

acl security update

Released 2026-09-24 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Enterprise Linux BaseOS E4S (v.8.8) acl-2.4.0-0.el8_8.1, libacl-2.4.0-0.el8_8.1, libacl-devel-2.4.0-0.el8_8.1
Red Hat Enterprise Linux BaseOS TUS (v.8.8) acl-2.4.0-0.el8_8.1, libacl-2.4.0-0.el8_8.1, libacl-devel-2.4.0-0.el8_8.1

Fixes 1 record

TI-2026-39261 CVE-2026-54369 · GHSA-53ch-pxc8-6g72

acl < 2.4.0 Symlink Traversal Privilege Escalation via libacl Functions

LOW 37

acl before version 2.4.0 contains a symlink traversal vulnerability in the libacl pathname-based functions acl_get_file(), acl_set_file(), acl_extended_file(), and acl_delete_def_file() that allows local attackers to esc…

CVSS 4.0HIGH 8.4 Local Low privileges No interaction EPSS 0.00153 Published 2026-06-29 Partial fix · 2.4.0 CWE-59