CVE-2026-54369
EUVD-2026-4008529.06.2026, 14:16
acl before version 2.4.0 contains a symlink traversal vulnerability in the libacl pathname-based functions acl_get_file(), acl_set_file(), acl_extended_file(), and acl_delete_def_file() that allows local attackers to escalate privileges by replacing any pathname component with a symbolic link. Attackers who control any component of a pathname processed by a privileged caller can redirect ACL read or write operations to arbitrary files or directories, enabling unauthorized manipulation of access control lists and local privilege escalation.
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
| Vendor | Product | Version | Source |
|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | 0:2.4.0-1.el10_2 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Enterprise Linux 8 | 0:2.4.0-1.el8_10 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Enterprise Linux 9 | 0:2.4.0-1.el9_8 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Discovery 2 | 1784821670 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Discovery 2 | 1784821750 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Hardened Images | 2.4.0-0.1.hum1 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Insights proxy 1.5 | 1786433656 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift distributed tracing 3.10.2 | 1785704636 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Update Infrastructure 5 | 1784794818 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Update Infrastructure 5 | 1784794778 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Update Infrastructure 5 | 1784795112 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Update Infrastructure 5 | 1784794289 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Update Infrastructure 5 | 1784795076 ≤ 𝑥 < * | ADP |
| acl | acl | 𝑥 < 2.4.0 | CNA |
Debian Releases
Ubuntu Releases
Red Hat Enterprise Linux Releases
Amazon Linux Releases
Amazon Package | |||||
|---|---|---|---|---|---|
| acl |
| ||||
| acl-debuginfo |
| ||||
| acl-debugsource |
| ||||
| libacl |
| ||||
| libacl-debuginfo |
| ||||
| libacl-devel |
|
