CVE-2026-54369

EUVD-2026-40085
acl before version 2.4.0 contains a symlink traversal vulnerability in the libacl pathname-based functions acl_get_file(), acl_set_file(), acl_extended_file(), and acl_delete_def_file() that allows local attackers to escalate privileges by replacing any pathname component with a symbolic link. Attackers who control any component of a pathname processed by a privileged caller can redirect ACL read or write operations to arbitrary files or directories, enabling unauthorized manipulation of access control lists and local privilege escalation.
Link Following
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulnCheckCNA
7.1 HIGH
LOCAL
LOW
LOW
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 7.55%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
Red HatRed Hat Enterprise Linux 10
0:2.4.0-1.el10_2 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 10.0 Extended Update Support
0:2.4.0-0.el10_0.1 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 8
0:2.4.0-1.el8_10 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 9
0:2.4.0-1.el9_8 ≤
𝑥
< *
ADP
Red HatRed Hat OpenShift Container Platform 4.22
4.22.9.8.202608130832-0 ≤
𝑥
< *
ADP
Red HatRed Hat Discovery 2
1784821670 ≤
𝑥
< *
ADP
Red HatRed Hat Discovery 2
1784821750 ≤
𝑥
< *
ADP
Red HatRed Hat Hardened Images
2.4.0-0.1.hum1 ≤
𝑥
< *
ADP
Red HatRed Hat Insights proxy 1.5
1786433656 ≤
𝑥
< *
ADP
Red HatRed Hat OpenShift distributed tracing 3.10.2
1785704636 ≤
𝑥
< *
ADP
Red HatRed Hat Update Infrastructure 5
1784794818 ≤
𝑥
< *
ADP
Red HatRed Hat Update Infrastructure 5
1784794778 ≤
𝑥
< *
ADP
Red HatRed Hat Update Infrastructure 5
1784795112 ≤
𝑥
< *
ADP
Red HatRed Hat Update Infrastructure 5
1784794289 ≤
𝑥
< *
ADP
Red HatRed Hat Update Infrastructure 5
1784795076 ≤
𝑥
< *
ADP
Red HatRed Hat Update Infrastructure 5
1787241211 ≤
𝑥
< *
ADP
Red HatRed Hat Update Infrastructure 5
1787135742 ≤
𝑥
< *
ADP
Red HatRed Hat Update Infrastructure 5
1787241260 ≤
𝑥
< *
ADP
aclacl
𝑥
< 2.4.0
CNA
Debian logo
Debian Releases
Debian Product
Codename
acl
bookworm
postponed
bullseye
postponed
forky
2.4.0-1
fixed
sid
2.4.0-1
fixed
trixie
no-dsa
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
acl
bionic
ignored
focal
ignored
jammy
ignored
noble
ignored
questing
ignored
resolute
ignored
trusty
ignored
xenial
ignored
openSUSE logo
openSUSE / SLES Releases
openSUSE Product
Release
acl
suse enterprise desktop 15 SP7
2.4.0-150000.4.6.1
fixed
suse enterprise sap 15 SP4
2.4.0-150000.4.6.1
fixed
suse enterprise sap 15 SP5
2.4.0-150000.4.6.1
fixed
suse enterprise sap 15 SP6
2.4.0-150000.4.6.1
fixed
suse enterprise sap 15 SP7
2.4.0-150000.4.6.1
fixed
suse enterprise server 15 SP4
2.4.0-150000.4.6.1
fixed
suse enterprise server 15 SP5
2.4.0-150000.4.6.1
fixed
suse enterprise server 15 SP6
2.4.0-150000.4.6.1
fixed
suse enterprise server 15 SP7
2.4.0-150000.4.6.1
fixed
attr
suse enterprise desktop 15 SP7
2.6.0-150000.4.3.1
fixed
suse enterprise sap 15 SP4
2.6.0-150000.4.3.1
fixed
suse enterprise sap 15 SP5
2.6.0-150000.4.3.1
fixed
suse enterprise sap 15 SP6
2.6.0-150000.4.3.1
fixed
suse enterprise sap 15 SP7
2.6.0-150000.4.3.1
fixed
suse enterprise server 15 SP4
2.6.0-150000.4.3.1
fixed
suse enterprise server 15 SP5
2.6.0-150000.4.3.1
fixed
suse enterprise server 15 SP6
2.6.0-150000.4.3.1
fixed
suse enterprise server 15 SP7
2.6.0-150000.4.3.1
fixed
libacl-devel
suse enterprise desktop 15 SP7
2.4.0-150000.4.6.1
fixed
suse enterprise sap 15 SP4
2.4.0-150000.4.6.1
fixed
suse enterprise sap 15 SP5
2.4.0-150000.4.6.1
fixed
suse enterprise sap 15 SP6
2.4.0-150000.4.6.1
fixed
suse enterprise sap 15 SP7
2.4.0-150000.4.6.1
fixed
suse enterprise server 15 SP4
2.4.0-150000.4.6.1
fixed
suse enterprise server 15 SP5
2.4.0-150000.4.6.1
fixed
suse enterprise server 15 SP6
2.4.0-150000.4.6.1
fixed
suse enterprise server 15 SP7
2.4.0-150000.4.6.1
fixed
libacl1
suse enterprise desktop 15 SP7
2.4.0-150000.4.6.1
fixed
suse enterprise sap 15 SP4
2.4.0-150000.4.6.1
fixed
suse enterprise sap 15 SP5
2.4.0-150000.4.6.1
fixed
suse enterprise sap 15 SP6
2.4.0-150000.4.6.1
fixed
suse enterprise sap 15 SP7
2.4.0-150000.4.6.1
fixed
suse enterprise server 15 SP4
2.4.0-150000.4.6.1
fixed
suse enterprise server 15 SP5
2.4.0-150000.4.6.1
fixed
suse enterprise server 15 SP6
2.4.0-150000.4.6.1
fixed
suse enterprise server 15 SP7
2.4.0-150000.4.6.1
fixed
libacl1-32bit
suse enterprise desktop 15 SP7
2.4.0-150000.4.6.1
fixed
suse enterprise sap 15 SP4
2.4.0-150000.4.6.1
fixed
suse enterprise sap 15 SP5
2.4.0-150000.4.6.1
fixed
suse enterprise sap 15 SP6
2.4.0-150000.4.6.1
fixed
suse enterprise sap 15 SP7
2.4.0-150000.4.6.1
fixed
suse enterprise server 15 SP4
2.4.0-150000.4.6.1
fixed
suse enterprise server 15 SP5
2.4.0-150000.4.6.1
fixed
suse enterprise server 15 SP6
2.4.0-150000.4.6.1
fixed
suse enterprise server 15 SP7
2.4.0-150000.4.6.1
fixed
libattr-devel
suse enterprise desktop 15 SP7
2.6.0-150000.4.3.1
fixed
suse enterprise sap 15 SP4
2.6.0-150000.4.3.1
fixed
suse enterprise sap 15 SP5
2.6.0-150000.4.3.1
fixed
suse enterprise sap 15 SP6
2.6.0-150000.4.3.1
fixed
suse enterprise sap 15 SP7
2.6.0-150000.4.3.1
fixed
suse enterprise server 15 SP4
2.6.0-150000.4.3.1
fixed
suse enterprise server 15 SP5
2.6.0-150000.4.3.1
fixed
suse enterprise server 15 SP6
2.6.0-150000.4.3.1
fixed
suse enterprise server 15 SP7
2.6.0-150000.4.3.1
fixed
libattr1
suse enterprise desktop 15 SP7
2.6.0-150000.4.3.1
fixed
suse enterprise sap 15 SP4
2.6.0-150000.4.3.1
fixed
suse enterprise sap 15 SP5
2.6.0-150000.4.3.1
fixed
suse enterprise sap 15 SP6
2.6.0-150000.4.3.1
fixed
suse enterprise sap 15 SP7
2.6.0-150000.4.3.1
fixed
suse enterprise server 15 SP4
2.6.0-150000.4.3.1
fixed
suse enterprise server 15 SP5
2.6.0-150000.4.3.1
fixed
suse enterprise server 15 SP6
2.6.0-150000.4.3.1
fixed
suse enterprise server 15 SP7
2.6.0-150000.4.3.1
fixed
libattr1-32bit
suse enterprise desktop 15 SP7
2.6.0-150000.4.3.1
fixed
suse enterprise sap 15 SP4
2.6.0-150000.4.3.1
fixed
suse enterprise sap 15 SP5
2.6.0-150000.4.3.1
fixed
suse enterprise sap 15 SP6
2.6.0-150000.4.3.1
fixed
suse enterprise sap 15 SP7
2.6.0-150000.4.3.1
fixed
suse enterprise server 15 SP4
2.6.0-150000.4.3.1
fixed
suse enterprise server 15 SP5
2.6.0-150000.4.3.1
fixed
suse enterprise server 15 SP6
2.6.0-150000.4.3.1
fixed
suse enterprise server 15 SP7
2.6.0-150000.4.3.1
fixed
Red Hat logo
Red Hat Enterprise Linux Releases
Red Hat Product
Release
acl
RHEL 8
0:2.4.0-1.el8_10
fixed
RHEL 8.8 E4S
0:2.4.0-0.el8_8.1
fixed
RHEL 8.8 TUS
0:2.4.0-0.el8_8.1
fixed
RHEL 9
0:2.4.0-1.el9_8
fixed
libacl
RHEL 8
0:2.4.0-1.el8_10
fixed
RHEL 8.8 E4S
0:2.4.0-0.el8_8.1
fixed
RHEL 8.8 TUS
0:2.4.0-0.el8_8.1
fixed
RHEL 9
0:2.4.0-1.el9_8
fixed
libacl-devel
RHEL 8
0:2.4.0-1.el8_10
fixed
RHEL 8.8 E4S
0:2.4.0-0.el8_8.1
fixed
RHEL 8.8 TUS
0:2.4.0-0.el8_8.1
fixed
RHEL 9
0:2.4.0-1.el9_8
fixed
Amazon Linux logo
Amazon Linux Releases
Amazon Package
Release
acl
Amazon Linux 2
0:2.2.51-14.amzn2.0.1
fixed
Amazon Linux 2023
0:2.4.0-1.amzn2023.0.1
fixed
acl-debuginfo
Amazon Linux 2
0:2.2.51-14.amzn2.0.1
fixed
Amazon Linux 2023
0:2.4.0-1.amzn2023.0.1
fixed
acl-debugsource
Amazon Linux 2023
0:2.4.0-1.amzn2023.0.1
fixed
libacl
Amazon Linux 2
0:2.2.51-14.amzn2.0.1
fixed
Amazon Linux 2023
0:2.4.0-1.amzn2023.0.1
fixed
libacl-debuginfo
Amazon Linux 2023
0:2.4.0-1.amzn2023.0.1
fixed
libacl-devel
Amazon Linux 2
0:2.2.51-14.amzn2.0.1
fixed
Amazon Linux 2023
0:2.4.0-1.amzn2023.0.1
fixed
Azure Linux logo
Azure Linux Releases
Azure Package
Release
acl
Azure Linux 3.0
0:2.4.0-1.azl3
fixed
Common Weakness Enumeration
Vulnerability Media Exposure
References
https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=24a227d0ab8576612194f8a56c2314389adc74a5
https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=3589787cd589b34bdd9265936e17190b6d3f17d1
https://www.vulncheck.com/advisories/acl-symlink-traversal-privilege-escalation-via-libacl-functions
https://access.redhat.com/errata/RHSA-2026:34351
https://access.redhat.com/errata/RHSA-2026:42736
https://access.redhat.com/errata/RHSA-2026:42739
https://access.redhat.com/errata/RHSA-2026:43420
https://access.redhat.com/errata/RHSA-2026:44481
https://access.redhat.com/errata/RHSA-2026:46836
https://access.redhat.com/errata/RHSA-2026:50205
https://access.redhat.com/errata/RHSA-2026:53371
https://access.redhat.com/errata/RHSA-2026:54769
https://access.redhat.com/errata/RHSA-2026:58981
https://access.redhat.com/errata/RHSA-2026:64805
https://access.redhat.com/errata/RHSA-2026:67140
https://access.redhat.com/errata/RHSA-2026:67142
https://access.redhat.com/errata/RHSA-2026:67144
https://access.redhat.com/security/cve/CVE-2026-54369
https://bugzilla.redhat.com/show_bug.cgi?id=2490277
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54369.json