CVE-2026-54370

This package contains commands for manipulating POSIX access control lists, and the libacl.so dynamic library which contains the POSIX 1003.1e draft standard 17 functions for manipulating access control lists.

Security Fix(es):

acl before version 2.4.0 contains a symlink traversal vulnerability in the libacl pathname-based functions acl_get_file(), acl_set_file(), acl_extended_file(), and acl_delete_def_file() that allows local attackers to escalate privileges by replacing any pathname component with a symbolic link. Attackers who control any component of a pathname processed by a privileged caller can redirect ACL read or write operations to arbitrary files or directories, enabling unauthorized manipulation of access control lists and local privilege escalation.(CVE-2026-54369)

acl before version 2.4.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability that allows local attackers to escalate privileges by replacing a pathname component with a symbolic link between an lstat() check and subsequent symlink-following operations such as stat(), chown(), chmod(), acl_get_file(), and acl_set_file(). Attackers who control a pathname component can redirect file access control list operations to arbitrary files when getfacl, setfacl, or chacl is invoked by a privileged process over an attacker-controlled path, resulting in local privilege escalation.(CVE-2026-54370)

Access Control Lists (ACLs) are used to define fine-grained discretionary access rights for files and directories. The acl packages contain the getfacl and setfacl utilities needed for manipulating access control lists.

Security Fix(es):

• acl: Symlink traversal privilege escalation via libacl functions (CVE-2026-54369)

• acl: TOCTOU Symlink Traversal via getfacl/setfacl (CVE-2026-54370)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Access Control Lists (ACLs) are used to define fine-grained discretionary access rights for files and directories. The acl packages contain the getfacl and setfacl utilities needed for manipulating access control lists.

Security Fix(es):

• acl: Symlink traversal privilege escalation via libacl functions (CVE-2026-54369)

• acl: TOCTOU Symlink Traversal via getfacl/setfacl (CVE-2026-54370)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Access Control Lists (ACLs) are used to define fine-grained discretionary access rights for files and directories. The acl packages contain the getfacl and setfacl utilities needed for manipulating access control lists.

Security Fix(es):

• acl: Symlink traversal privilege escalation via libacl functions (CVE-2026-54369)

• acl: TOCTOU Symlink Traversal via getfacl/setfacl (CVE-2026-54370)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

acl before version 2.4.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability that allows local attackers to escalate privileges by replacing a pathname component with a symbolic link between an lstat() check and subsequent symlink-following operations such as stat(), chown(), chmod(), acl_get_file(), and acl_set_file(). Attackers who control a pathname component can redirect file access control list operations to arbitrary files when getfacl, setfacl, or chacl is invoked by a privileged process over an attacker-controlled path, resulting in local privilege escalation.

Access Control Lists (ACLs) are used to define fine-grained discretionary access rights for files and directories. The acl packages contain the getfacl and setfacl utilities needed for manipulating access control lists.

Security Fix(es):

• acl: Symlink traversal privilege escalation via libacl functions (CVE-2026-54369)
• acl: TOCTOU Symlink Traversal via getfacl/setfacl (CVE-2026-54370)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Access Control Lists (ACLs) are used to define fine-grained discretionary access rights for files and directories. The acl packages contain the getfacl and setfacl utilities needed for manipulating access control lists.

Security Fix(es):

• acl: Symlink traversal privilege escalation via libacl functions (CVE-2026-54369)
• acl: TOCTOU Symlink Traversal via getfacl/setfacl (CVE-2026-54370)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Access Control Lists (ACLs) are used to define fine-grained discretionary access rights for files and directories. The acl packages contain the getfacl and setfacl utilities needed for manipulating access control lists.

Security Fix(es):

• acl: Symlink traversal privilege escalation via libacl functions (CVE-2026-54369)
• acl: TOCTOU Symlink Traversal via getfacl/setfacl (CVE-2026-54370)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

acl before version 2.4.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability that allows local attackers to escalate privileges by replacing a pathname component with a symbolic link between an lstat() check and subsequent symlink-following operations such as stat(), chown(), chmod(), acl_get_file(), and acl_set_file(). Attackers who control a pathname component can redirect file access control list operations to arbitrary files when getfacl, setfacl, or chacl is invoked by a privileged process over an attacker-controlled path, resulting in local privilege escalation.

• rebase to 2.4.0 to fix CVE-2026-54369 and CVE-2026-54370

• rebase to 2.4.0 to fix CVE-2026-54369 and CVE-2026-54370

• rebase to 2.4.0 to fix CVE-2026-54369 and CVE-2026-54370

• rebase to 2.4.0 to fix CVE-2026-54369 and CVE-2026-54370

• rebase to 2.4.0 to fix CVE-2026-54369 and CVE-2026-54370

The updated acl and attr packages fix security issues.

These are all security issues fixed in the acl-2.4.0-1.1 package on the GA media of openSUSE Tumbleweed.

This update for acl, attr fixes the following issue:

• CVE-2026-54369,CVE-2026-54370,CVE-2026-54371: Symlink Traversal Privilege Escalation via getfattr/setfattr, getfacl/setfacl/chacl, libacl (bsc#1268867).

Changes for acl:

• Update to 2.4.0 (jsc#PED-16501): Major Issues Fixed:
• The libacl library functions acl_get_file(), acl_set_file(), acl_extended_file(), and acl_delete_def_file() take a pathname argument and follow symbolic links. When a privileged user calls one of those functions, an attacker that controls a pathname component can replace a file or directory with a symbolic link and redirect the operation to a different file. This can lead to local privilege escalation. (CVE-2026-54369, bsc#1268867) The library functions cannot be fixed without breaking compatibility; the described behaviour is by design. Instead, version 2.4.0 of the acl package introduces the additional functions acl_get_file_at(), acl_set_file_at(), acl_extended_file_at(), and acl_delete_def_file_at(). These functions each take a dirfd file descriptor argument and an at_flags argument and accept the AT_SYMLINK_NOFOLLOW and AT_EMPTY_PATH flags. Use these functions to control when to follow symbolic links. (CVE-2026-54370, bsc#1268867) In addition, the libacl functions acl_get_fd(), acl_set_fd(), and acl_extended_fd() functions always operate on the access ACL; the library previously did not offer a way to operate on the default ACL of a directory file descriptor. The new functions remove that restriction. It will be up to each individual program to start using these new library functions where appropriate.
• When walking directory trees, the getfacl, setfacl, chacl, and getfattr utilities constructed the full pathname of each file in the tree and use that pathname to access the file. When a privileged user used those utilities, an attacker that controlled a pathname component could replace a directory with a symbolic link and redirect the operation to a different file, leading to a local privilege escalation. (CVE-2026-54371, bsc#1268867) This is fixed by using directory file descriptors and operating relative to those directory file descriptors.
• When resolving the final pathname component, the getfacl, setfacl, chacl, getfattr, and setfattr utilities in some cases used functions that resolve symbolic links. This includes the above mentioned libacl functions, but also stat(), chmod(), and chown(). This is fixed by using symlink-safe functions throughout the code.
• When restoring a backup, the setfacl and setfattr utilities read the full pathnames of files from the backup. When those pathnames were resolved, pathname components that are symbolic links were traversed. An attacker that controlled a pathname component could replace it with a symbolic link, causing a privileged user to operate on a file other than the one intended. This could lead to the same kind of local privilege escalation as discussed before. This is fixed by using openat2(RESOLVE_NO_SYMLINKS) to resolve the directory components of a pathname, but see Compatibility Notes below for the details. Minor Issues Fixed:
• When a symbolic link was specified on the command line but symbolic link traversal was disabled using option -P (--physical), the getfacl and setfacl utilities previously silently ignored the symlink. Now, an ELOOP ("Too many levels of symbolic links") error will result instead.
• acl_delete_entry() now verifies that the specified entry belongs to the specified acl.
• Numeric uids and gids that cannot be represented in types uid_t and gid_t are checked more carefully and invalid numbers are rejected.
• Functions acl_get_file(), acl_get_file_at(), and acl_get_fd() will retry several times when the size of an ACL grows unexpectedly; previously, they only grew the allocated buffer once before giving up.
• When passed a directory file descriptor, function perm_copy_fd() didn't copy the default ACL from one…

Root has patched CVE-2026-54370 in the acl package for Root:Debian:11. Multiple fixed versions available.

Root has patched CVE-2026-54370 in the acl package for Root:Debian:12. Multiple fixed versions available.

Root has patched CVE-2026-54370 in the acl package for Root:Debian:13. Multiple fixed versions available.

This update for acl, attr fixes the following issue:

• CVE-2026-54369,CVE-2026-54370,CVE-2026-54371: Symlink Traversal Privilege Escalation via getfattr/setfattr, getfacl/setfacl/chacl, libacl (bsc#1268867).

Changes for acl:

• Update to 2.4.0 (jsc#PED-16501): Major Issues Fixed:
• The libacl library functions acl_get_file(), acl_set_file(), acl_extended_file(), and acl_delete_def_file() take a pathname argument and follow symbolic links. When a privileged user calls one of those functions, an attacker that controls a pathname component can replace a file or directory with a symbolic link and redirect the operation to a different file. This can lead to local privilege escalation. (CVE-2026-54369, bsc#1268867) The library functions cannot be fixed without breaking compatibility; the described behaviour is by design. Instead, version 2.4.0 of the acl package introduces the additional functions acl_get_file_at(), acl_set_file_at(), acl_extended_file_at(), and acl_delete_def_file_at(). These functions each take a dirfd file descriptor argument and an at_flags argument and accept the AT_SYMLINK_NOFOLLOW and AT_EMPTY_PATH flags. Use these functions to control when to follow symbolic links. (CVE-2026-54370, bsc#1268867) In addition, the libacl functions acl_get_fd(), acl_set_fd(), and acl_extended_fd() functions always operate on the access ACL; the library previously did not offer a way to operate on the default ACL of a directory file descriptor. The new functions remove that restriction. It will be up to each individual program to start using these new library functions where appropriate.
• When walking directory trees, the getfacl, setfacl, chacl, and getfattr utilities constructed the full pathname of each file in the tree and use that pathname to access the file. When a privileged user used those utilities, an attacker that controlled a pathname component could replace a directory with a symbolic link and redirect the operation to a different file, leading to a local privilege escalation. (CVE-2026-54371, bsc#1268867) This is fixed by using directory file descriptors and operating relative to those directory file descriptors.
• When resolving the final pathname component, the getfacl, setfacl, chacl, getfattr, and setfattr utilities in some cases used functions that resolve symbolic links. This includes the above mentioned libacl functions, but also stat(), chmod(), and chown(). This is fixed by using symlink-safe functions throughout the code.
• When restoring a backup, the setfacl and setfattr utilities read the full pathnames of files from the backup. When those pathnames were resolved, pathname components that are symbolic links were traversed. An attacker that controlled a pathname component could replace it with a symbolic link, causing a privileged user to operate on a file other than the one intended. This could lead to the same kind of local privilege escalation as discussed before. This is fixed by using openat2(RESOLVE_NO_SYMLINKS) to resolve the directory components of a pathname, but see Compatibility Notes below for the details. Minor Issues Fixed:
• When a symbolic link was specified on the command line but symbolic link traversal was disabled using option -P (--physical), the getfacl and setfacl utilities previously silently ignored the symlink. Now, an ELOOP ("Too many levels of symbolic links") error will result instead.
• acl_delete_entry() now verifies that the specified entry belongs to the specified acl.
• Numeric uids and gids that cannot be represented in types uid_t and gid_t are checked more carefully and invalid numbers are rejected.
• Functions acl_get_file(), acl_get_file_at(), and acl_get_fd() will retry several times when the size of an ACL grows unexpectedly; previously, they only grew the allocated buffer once before giving up.
• When passed a directory file descriptor, function perm_copy_fd() didn't copy the default ACL from one…

This update for acl, attr fixes the following issue:

• CVE-2026-54369,CVE-2026-54370,CVE-2026-54371: Symlink Traversal Privilege Escalation via getfattr/setfattr, getfacl/setfacl/chacl, libacl (bsc#1268867).

Changes for acl:

• Update to 2.4.0 (jsc#PED-16501): Major Issues Fixed:
• The libacl library functions acl_get_file(), acl_set_file(), acl_extended_file(), and acl_delete_def_file() take a pathname argument and follow symbolic links. When a privileged user calls one of those functions, an attacker that controls a pathname component can replace a file or directory with a symbolic link and redirect the operation to a different file. This can lead to local privilege escalation. (CVE-2026-54369, bsc#1268867) The library functions cannot be fixed without breaking compatibility; the described behaviour is by design. Instead, version 2.4.0 of the acl package introduces the additional functions acl_get_file_at(), acl_set_file_at(), acl_extended_file_at(), and acl_delete_def_file_at(). These functions each take a dirfd file descriptor argument and an at_flags argument and accept the AT_SYMLINK_NOFOLLOW and AT_EMPTY_PATH flags. Use these functions to control when to follow symbolic links. (CVE-2026-54370, bsc#1268867) In addition, the libacl functions acl_get_fd(), acl_set_fd(), and acl_extended_fd() functions always operate on the access ACL; the library previously did not offer a way to operate on the default ACL of a directory file descriptor. The new functions remove that restriction. It will be up to each individual program to start using these new library functions where appropriate.
• When walking directory trees, the getfacl, setfacl, chacl, and getfattr utilities constructed the full pathname of each file in the tree and use that pathname to access the file. When a privileged user used those utilities, an attacker that controlled a pathname component could replace a directory with a symbolic link and redirect the operation to a different file, leading to a local privilege escalation. (CVE-2026-54371, bsc#1268867) This is fixed by using directory file descriptors and operating relative to those directory file descriptors.
• When resolving the final pathname component, the getfacl, setfacl, chacl, getfattr, and setfattr utilities in some cases used functions that resolve symbolic links. This includes the above mentioned libacl functions, but also stat(), chmod(), and chown(). This is fixed by using symlink-safe functions throughout the code.
• When restoring a backup, the setfacl and setfattr utilities read the full pathnames of files from the backup. When those pathnames were resolved, pathname components that are symbolic links were traversed. An attacker that controlled a pathname component could replace it with a symbolic link, causing a privileged user to operate on a file other than the one intended. This could lead to the same kind of local privilege escalation as discussed before. This is fixed by using openat2(RESOLVE_NO_SYMLINKS) to resolve the directory components of a pathname, but see Compatibility Notes below for the details. Minor Issues Fixed:
• When a symbolic link was specified on the command line but symbolic link traversal was disabled using option -P (--physical), the getfacl and setfacl utilities previously silently ignored the symlink. Now, an ELOOP ("Too many levels of symbolic links") error will result instead.
• acl_delete_entry() now verifies that the specified entry belongs to the specified acl.
• Numeric uids and gids that cannot be represented in types uid_t and gid_t are checked more carefully and invalid numbers are rejected.
• Functions acl_get_file(), acl_get_file_at(), and acl_get_fd() will retry several times when the size of an ACL grows unexpectedly; previously, they only grew the allocated buffer once before giving up.
• When passed a directory file descriptor, function perm_copy_fd() didn't copy the default ACL from one…

This update for acl, attr fixes the following issue:

• CVE-2026-54369,CVE-2026-54370,CVE-2026-54371: Symlink Traversal Privilege Escalation via getfattr/setfattr, getfacl/setfacl/chacl, libacl (bsc#1268867).

Changes for acl:

• Update to 2.4.0 (jsc#PED-16501): Major Issues Fixed:
• The libacl library functions acl_get_file(), acl_set_file(), acl_extended_file(), and acl_delete_def_file() take a pathname argument and follow symbolic links. When a privileged user calls one of those functions, an attacker that controls a pathname component can replace a file or directory with a symbolic link and redirect the operation to a different file. This can lead to local privilege escalation. (CVE-2026-54369, bsc#1268867) The library functions cannot be fixed without breaking compatibility; the described behaviour is by design. Instead, version 2.4.0 of the acl package introduces the additional functions acl_get_file_at(), acl_set_file_at(), acl_extended_file_at(), and acl_delete_def_file_at(). These functions each take a dirfd file descriptor argument and an at_flags argument and accept the AT_SYMLINK_NOFOLLOW and AT_EMPTY_PATH flags. Use these functions to control when to follow symbolic links. (CVE-2026-54370, bsc#1268867) In addition, the libacl functions acl_get_fd(), acl_set_fd(), and acl_extended_fd() functions always operate on the access ACL; the library previously did not offer a way to operate on the default ACL of a directory file descriptor. The new functions remove that restriction. It will be up to each individual program to start using these new library functions where appropriate.
• When walking directory trees, the getfacl, setfacl, chacl, and getfattr utilities constructed the full pathname of each file in the tree and use that pathname to access the file. When a privileged user used those utilities, an attacker that controlled a pathname component could replace a directory with a symbolic link and redirect the operation to a different file, leading to a local privilege escalation. (CVE-2026-54371, bsc#1268867) This is fixed by using directory file descriptors and operating relative to those directory file descriptors.
• When resolving the final pathname component, the getfacl, setfacl, chacl, getfattr, and setfattr utilities in some cases used functions that resolve symbolic links. This includes the above mentioned libacl functions, but also stat(), chmod(), and chown(). This is fixed by using symlink-safe functions throughout the code.
• When restoring a backup, the setfacl and setfattr utilities read the full pathnames of files from the backup. When those pathnames were resolved, pathname components that are symbolic links were traversed. An attacker that controlled a pathname component could replace it with a symbolic link, causing a privileged user to operate on a file other than the one intended. This could lead to the same kind of local privilege escalation as discussed before. This is fixed by using openat2(RESOLVE_NO_SYMLINKS) to resolve the directory components of a pathname, but see Compatibility Notes below for the details. Minor Issues Fixed:
• When a symbolic link was specified on the command line but symbolic link traversal was disabled using option -P (--physical), the getfacl and setfacl utilities previously silently ignored the symlink. Now, an ELOOP ("Too many levels of symbolic links") error will result instead.
• acl_delete_entry() now verifies that the specified entry belongs to the specified acl.
• Numeric uids and gids that cannot be represented in types uid_t and gid_t are checked more carefully and invalid numbers are rejected.
• Functions acl_get_file(), acl_get_file_at(), and acl_get_fd() will retry several times when the size of an ACL grows unexpectedly; previously, they only grew the allocated buffer once before giving up.
• When passed a directory file descriptor, function perm_copy_fd() didn't copy the default ACL from one…

This update for acl, attr fixes the following issue:

• CVE-2026-54369,CVE-2026-54370,CVE-2026-54371: Symlink Traversal Privilege Escalation via getfattr/setfattr, getfacl/setfacl/chacl, libacl (bsc#1268867).

Changes for acl:

• Update to 2.4.0 (jsc#PED-16501): Major Issues Fixed:
• The libacl library functions acl_get_file(), acl_set_file(), acl_extended_file(), and acl_delete_def_file() take a pathname argument and follow symbolic links. When a privileged user calls one of those functions, an attacker that controls a pathname component can replace a file or directory with a symbolic link and redirect the operation to a different file. This can lead to local privilege escalation. (CVE-2026-54369, bsc#1268867) The library functions cannot be fixed without breaking compatibility; the described behaviour is by design. Instead, version 2.4.0 of the acl package introduces the additional functions acl_get_file_at(), acl_set_file_at(), acl_extended_file_at(), and acl_delete_def_file_at(). These functions each take a dirfd file descriptor argument and an at_flags argument and accept the AT_SYMLINK_NOFOLLOW and AT_EMPTY_PATH flags. Use these functions to control when to follow symbolic links. (CVE-2026-54370, bsc#1268867) In addition, the libacl functions acl_get_fd(), acl_set_fd(), and acl_extended_fd() functions always operate on the access ACL; the library previously did not offer a way to operate on the default ACL of a directory file descriptor. The new functions remove that restriction. It will be up to each individual program to start using these new library functions where appropriate.
• When walking directory trees, the getfacl, setfacl, chacl, and getfattr utilities constructed the full pathname of each file in the tree and use that pathname to access the file. When a privileged user used those utilities, an attacker that controlled a pathname component could replace a directory with a symbolic link and redirect the operation to a different file, leading to a local privilege escalation. (CVE-2026-54371, bsc#1268867) This is fixed by using directory file descriptors and operating relative to those directory file descriptors.
• When resolving the final pathname component, the getfacl, setfacl, chacl, getfattr, and setfattr utilities in some cases used functions that resolve symbolic links. This includes the above mentioned libacl functions, but also stat(), chmod(), and chown(). This is fixed by using symlink-safe functions throughout the code.
• When restoring a backup, the setfacl and setfattr utilities read the full pathnames of files from the backup. When those pathnames were resolved, pathname components that are symbolic links were traversed. An attacker that controlled a pathname component could replace it with a symbolic link, causing a privileged user to operate on a file other than the one intended. This could lead to the same kind of local privilege escalation as discussed before. This is fixed by using openat2(RESOLVE_NO_SYMLINKS) to resolve the directory components of a pathname, but see Compatibility Notes below for the details. Minor Issues Fixed:
• When a symbolic link was specified on the command line but symbolic link traversal was disabled using option -P (--physical), the getfacl and setfacl utilities previously silently ignored the symlink. Now, an ELOOP ('Too many levels of symbolic links') error will result instead.
• acl_delete_entry() now verifies that the specified entry belongs to the specified acl.
• Numeric uids and gids that cannot be represented in types uid_t and gid_t are checked more carefully and invalid numbers are rejected.
• Functions acl_get_file(), acl_get_file_at(), and acl_get_fd() will retry several times when the size of an ACL grows unexpectedly; previously, they only grew the allocated buffer once before giving up.
• When passed a directory file descriptor, function perm_copy_fd() didn't copy the default ACL from one…