{"id":"CVE-2026-54369","aliases":["ALSA-2026:42736","ALSA-2026:42739","ALSA-2026:43420","AZL-91397","CLSA-2026-1784909800","CLSA-2026-1784982822","CLSA-2026-1785151239","CLSA-2026-1785151263","CLSA-2026-1785151703","DEBIAN-CVE-2026-54369","EUVD-2026-40085","GHSA-53ch-pxc8-6g72","MGASA-2026-0321","OESA-2026-3079","RHSA-2026:34351","RHSA-2026:42736","RHSA-2026:42739","RHSA-2026:43420","RHSA-2026:64805","RHSA-2026:67140","RHSA-2026:67142","RHSA-2026:67144","RHSA-2026:71656","RHSA-2026:72819","RHSA-2026:72820","RLSA-2026:42736","RLSA-2026:42739","RLSA-2026:43420","ROOT-OS-DEBIAN-11-CVE-2026-54369","ROOT-OS-DEBIAN-12-CVE-2026-54369","ROOT-OS-DEBIAN-13-CVE-2026-54369","SUSE-SU-2026:23670-1","SUSE-SU-2026:23705-1","SUSE-SU-2026:23726-1","SUSE-SU-2026:4176-1","UBUNTU-CVE-2026-54369","openSUSE-SU-2026:11312-1","openSUSE-SU-2026:21832-1"],"status":"published","title":"acl \u003c 2.4.0 Symlink Traversal Privilege Escalation via libacl Functions","description":"acl before version 2.4.0 contains a symlink traversal vulnerability in the libacl pathname-based functions acl_get_file(), acl_set_file(), acl_extended_file(), and acl_delete_def_file() that allows local attackers to escalate privileges by replacing any pathname component with a symbolic link. Attackers who control any component of a pathname processed by a privileged caller can redirect ACL read or write operations to arbitrary files or directories, enabling unauthorized manipulation of access control lists and local privilege escalation.","severity":{"version":"4.0","score":8.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00153,"percentile":0.04516,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-59"],"published":"2026-06-29T12:37:21Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"Azure Linux:3","package":"acl","fixed_in":["2.4.0-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"acl","fixed_in":["2.4.0-1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"libacl-debuginfo","fixed_in":["0:2.4.0-0.el10_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"acl","fixed_in":["0:2.4.0-0.el10_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"libacl","fixed_in":["0:2.4.0-0.el10_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"acl-debuginfo","fixed_in":["0:2.4.0-0.el9_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"acl-debugsource","fixed_in":["0:2.4.0-0.el9_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.6::baseos","package":"acl","fixed_in":["0:2.4.0-0.el9_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.6::baseos","package":"acl-debuginfo","fixed_in":["0:2.4.0-0.el9_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.6::baseos","package":"acl-debugsource","fixed_in":["0:2.4.0-0.el9_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"acl-debuginfo","fixed_in":["0:2.4.0-0.el9_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"acl-debugsource","fixed_in":["0:2.4.0-0.el9_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.2::baseos","package":"acl","fixed_in":["0:2.4.0-0.el9_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.2::baseos","package":"acl-debuginfo","fixed_in":["0:2.4.0-0.el9_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.2::baseos","package":"acl-debugsource","fixed_in":["0:2.4.0-0.el9_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"acl-debuginfo","fixed_in":["0:2.4.0-0.el9_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"acl-debugsource","fixed_in":["0:2.4.0-0.el9_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.4::baseos","package":"acl","fixed_in":["0:2.4.0-0.el9_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.4::baseos","package":"acl-debuginfo","fixed_in":["0:2.4.0-0.el9_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.4::baseos","package":"acl-debugsource","fixed_in":["0:2.4.0-0.el9_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.8::baseos","package":"acl","fixed_in":["0:2.4.0-0.el8_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.8::baseos","package":"acl-debuginfo","fixed_in":["0:2.4.0-0.el8_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.8::baseos","package":"acl-debugsource","fixed_in":["0:2.4.0-0.el8_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.8::baseos","package":"libacl","fixed_in":["0:2.4.0-0.el8_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.8::baseos","package":"libacl-debuginfo","fixed_in":["0:2.4.0-0.el8_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.8::baseos","package":"libacl-devel","fixed_in":["0:2.4.0-0.el8_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.8::baseos","package":"acl","fixed_in":["0:2.4.0-0.el8_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.8::baseos","package":"acl-debuginfo","fixed_in":["0:2.4.0-0.el8_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.8::baseos","package":"acl-debugsource","fixed_in":["0:2.4.0-0.el8_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.8::baseos","package":"libacl","fixed_in":["0:2.4.0-0.el8_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.8::baseos","package":"libacl-debuginfo","fixed_in":["0:2.4.0-0.el8_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.8::baseos","package":"libacl-devel","fixed_in":["0:2.4.0-0.el8_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.6::baseos","package":"acl","fixed_in":["0:2.4.0-0.el8_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.6::baseos","package":"acl-debuginfo","fixed_in":["0:2.4.0-0.el8_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.6::baseos","package":"acl-debugsource","fixed_in":["0:2.4.0-0.el8_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.6::baseos","package":"libacl","fixed_in":["0:2.4.0-0.el8_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.6::baseos","package":"libacl-debuginfo","fixed_in":["0:2.4.0-0.el8_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.6::baseos","package":"libacl-devel","fixed_in":["0:2.4.0-0.el8_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus_long_life:8.6::baseos","package":"acl","fixed_in":["0:2.4.0-0.el8_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus_long_life:8.6::baseos","package":"acl-debuginfo","fixed_in":["0:2.4.0-0.el8_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus_long_life:8.6::baseos","package":"acl-debugsource","fixed_in":["0:2.4.0-0.el8_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus_long_life:8.6::baseos","package":"libacl","fixed_in":["0:2.4.0-0.el8_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus_long_life:8.6::baseos","package":"libacl-debuginfo","fixed_in":["0:2.4.0-0.el8_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus_long_life:8.6::baseos","package":"libacl-devel","fixed_in":["0:2.4.0-0.el8_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.4::baseos","package":"acl","fixed_in":["0:2.4.0-0.el8_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.4::baseos","package":"acl-debuginfo","fixed_in":["0:2.4.0-0.el8_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.4::baseos","package":"acl-debugsource","fixed_in":["0:2.4.0-0.el8_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.4::baseos","package":"libacl","fixed_in":["0:2.4.0-0.el8_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.4::baseos","package":"libacl-debuginfo","fixed_in":["0:2.4.0-0.el8_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.4::baseos","package":"libacl-devel","fixed_in":["0:2.4.0-0.el8_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus_long_life:8.4::baseos","package":"acl","fixed_in":["0:2.4.0-0.el8_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus_long_life:8.4::baseos","package":"acl-debuginfo","fixed_in":["0:2.4.0-0.el8_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus_long_life:8.4::baseos","package":"acl-debugsource","fixed_in":["0:2.4.0-0.el8_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus_long_life:8.4::baseos","package":"libacl","fixed_in":["0:2.4.0-0.el8_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus_long_life:8.4::baseos","package":"libacl-debuginfo","fixed_in":["0:2.4.0-0.el8_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus_long_life:8.4::baseos","package":"libacl-devel","fixed_in":["0:2.4.0-0.el8_4.1"],"sources":["osv"]},{"ecosystem":"Root:Debian:11","package":"acl","fixed_in":["2.2.53-10.aikido.2","2.2.53-10.aikido.3","2.2.53-10.root.io.1"],"sources":["osv"]},{"ecosystem":"Root:Debian:11","package":"rootio-acl","fixed_in":["2.2.53-10.aikido.2","2.2.53-10.aikido.3","2.2.53-10.root.io.1"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"acl","fixed_in":["2.3.1-3.aikido.2","2.3.1-3.aikido.3","2.3.1-3.root.io.1"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"rootio-acl","fixed_in":["2.3.1-3.aikido.2","2.3.1-3.aikido.3","2.3.1-3.root.io.1"],"sources":["osv"]},{"ecosystem":"Root:Debian:13","package":"acl","fixed_in":["2.3.2-2.aikido.2","2.3.2-2.root.io.1","2.3.2-2.aikido.6","2.3.2-2.aikido.3","2.3.2-2.aikido.4","2.3.2-2.aikido.5"],"sources":["osv"]},{"ecosystem":"Root:Debian:13","package":"rootio-acl","fixed_in":["2.3.2-2.aikido.2","2.3.2-2.root.io.1","2.3.2-2.aikido.6","2.3.2-2.aikido.3","2.3.2-2.aikido.4","2.3.2-2.aikido.5"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:9","package":"acl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-1.el9_8"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"libacl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-1.el9_8"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"libacl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-1.el9_8"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:10","package":"acl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:10","package":"libacl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:10","package":"libacl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"acl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-1.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"libacl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-1.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"libacl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-1.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Azure Linux:3","package":"acl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"acl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-1.el9_2.tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"libacl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-1.el9_2.tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"libacl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-1.el9_2.tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"acl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-1.el9_6.tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"libacl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-1.el9_6.tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"libacl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-1.el9_6.tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"acl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-1.el8.tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"libacl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-1.el8.tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"libacl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-1.el8.tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"acl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-1.el8.tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"libacl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-1.el8.tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"libacl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-1.el8.tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"acl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-1.el8.tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"libacl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-1.el8.tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"libacl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-1.el8.tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"Debian:12","package":"acl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.3.1-3","2.3.1-4","2.3.1-5","2.3.1-6","2.3.2-1","2.3.2-2","2.3.2-3","2.4.0-1"]},{"source":"osv","ecosystem":"Debian:13","package":"acl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.3.2-2","2.3.2-3","2.4.0-1"]},{"source":"osv","ecosystem":"Debian:14","package":"acl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-1"}]}],"versions":["2.3.2-2","2.3.2-3"]},{"source":"osv","ecosystem":"Mageia:10","package":"acl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-3.mga10"}]}],"bundled":3},{"source":"osv","ecosystem":"Mageia:10","package":"attr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.0-1.mga10"}]}],"bundled":3},{"source":"osv","ecosystem":"Mageia:9","package":"acl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-1.mga9"}]}],"bundled":3},{"source":"osv","ecosystem":"Mageia:9","package":"attr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.0-1.mga9"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"acl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.53-14.oe2003sp4"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"acl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.1-7.oe2203sp4"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"acl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.1-7.oe2403sp1"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"acl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.1-7.oe2403sp3"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP4","package":"acl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.1-7.oe2403sp4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"acl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.0-0.1.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libacl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.0-0.1.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libacl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.0-0.1.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libacl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.0-1.el9_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libacl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.0-1.el9_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"acl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.0-1.el9_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"libacl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.0-1.el9_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"libacl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.0-1.el9_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"acl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.0-1.el9_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"acl-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.0-1.el9_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"acl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.0-1.el9_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"acl-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.0-1.el9_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"libacl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.0-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"libacl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.0-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"acl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.0-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"libacl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.0-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"acl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.0-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"acl-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.0-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"acl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.0-1.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libacl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.0-1.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libacl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.0-1.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libacl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.0-1.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"acl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.0-1.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"acl-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.0-1.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"libacl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.0-0.el10_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"acl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.0-0.el10_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"libacl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.0-0.el10_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"acl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.0-0.el9_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"acl-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.0-0.el9_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::baseos","package":"acl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.0-0.el9_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::baseos","package":"acl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.0-0.el9_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::baseos","package":"acl-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.0-0.el9_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"acl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.0-0.el9_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"acl-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.0-0.el9_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::baseos","package":"acl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.0-0.el9_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::baseos","package":"acl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.0-0.el9_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::baseos","package":"acl-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.0-0.el9_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"acl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.0-0.el9_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"acl-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.0-0.el9_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::baseos","package":"acl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.0-0.el9_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::baseos","package":"acl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.0-0.el9_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::baseos","package":"acl-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.0-0.el9_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::baseos","package":"acl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.0-0.el8_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::baseos","package":"acl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.0-0.el8_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::baseos","package":"acl-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.0-0.el8_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::baseos","package":"libacl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.0-0.el8_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::baseos","package":"libacl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.0-0.el8_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::baseos","package":"libacl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.0-0.el8_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::baseos","package":"acl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.0-0.el8_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::baseos","package":"acl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.0-0.el8_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::baseos","package":"acl-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.0-0.el8_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::baseos","package":"libacl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.0-0.el8_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::baseos","package":"libacl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.0-0.el8_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::baseos","package":"libacl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.0-0.el8_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::baseos","package":"acl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.0-0.el8_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::baseos","package":"acl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.0-0.el8_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::baseos","package":"acl-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.0-0.el8_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::baseos","package":"libacl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.0-0.el8_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::baseos","package":"libacl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.0-0.el8_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::baseos","package":"libacl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.0-0.el8_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.6::baseos","package":"acl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.0-0.el8_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.6::baseos","package":"acl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.0-0.el8_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.6::baseos","package":"acl-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.0-0.el8_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.6::baseos","package":"libacl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.0-0.el8_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.6::baseos","package":"libacl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.0-0.el8_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.6::baseos","package":"libacl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.0-0.el8_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::baseos","package":"acl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.0-0.el8_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::baseos","package":"acl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.0-0.el8_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::baseos","package":"acl-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.0-0.el8_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::baseos","package":"libacl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.0-0.el8_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::baseos","package":"libacl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.0-0.el8_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::baseos","package":"libacl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.0-0.el8_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.4::baseos","package":"acl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.0-0.el8_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.4::baseos","package":"acl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.0-0.el8_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.4::baseos","package":"acl-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.0-0.el8_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.4::baseos","package":"libacl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.0-0.el8_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.4::baseos","package":"libacl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.0-0.el8_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.4::baseos","package":"libacl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.0-0.el8_4.1"}]}]},{"source":"osv","ecosystem":"Rocky Linux:9","package":"acl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.0-1.el9_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:10","package":"acl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.0-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"acl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.0-1.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Root:Debian:11","package":"acl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.53-10.aikido.2"},{"fixed":"2.2.53-10.aikido.3"},{"fixed":"2.2.53-10.root.io.1"}]}]},{"source":"osv","ecosystem":"Root:Debian:11","package":"rootio-acl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.53-10.aikido.2"},{"fixed":"2.2.53-10.aikido.3"},{"fixed":"2.2.53-10.root.io.1"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"acl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.1-3.aikido.2"},{"fixed":"2.3.1-3.aikido.3"},{"fixed":"2.3.1-3.root.io.1"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"rootio-acl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.1-3.aikido.2"},{"fixed":"2.3.1-3.aikido.3"},{"fixed":"2.3.1-3.root.io.1"}]}]},{"source":"osv","ecosystem":"Root:Debian:13","package":"acl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.2-2.aikido.2"},{"fixed":"2.3.2-2.root.io.1"},{"fixed":"2.3.2-2.aikido.6"},{"fixed":"2.3.2-2.aikido.3"},{"fixed":"2.3.2-2.aikido.4"},{"fixed":"2.3.2-2.aikido.5"}]}]},{"source":"osv","ecosystem":"Root:Debian:13","package":"rootio-acl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.2-2.aikido.2"},{"fixed":"2.3.2-2.root.io.1"},{"fixed":"2.3.2-2.aikido.6"},{"fixed":"2.3.2-2.aikido.3"},{"fixed":"2.3.2-2.aikido.4"},{"fixed":"2.3.2-2.aikido.5"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"acl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-160000.1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"attr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.0-160000.1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"acl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-160000.1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"attr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.0-160000.1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"acl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-160000.1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"attr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.0-160000.1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"acl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-160000.1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"attr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.0-160000.1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"acl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-160000.1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"attr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.0-160000.1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"acl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-150000.4.6.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"attr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.0-150000.4.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"acl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-150000.4.6.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"attr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.0-150000.4.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"acl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-150000.4.6.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"attr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.0-150000.4.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"acl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-150000.4.6.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"attr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.0-150000.4.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"acl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-150000.4.6.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"attr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.0-150000.4.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"acl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-150000.4.6.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"attr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.0-150000.4.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"acl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-150000.4.6.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"attr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.0-150000.4.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"acl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-150000.4.6.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"attr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.0-150000.4.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"acl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-150000.4.6.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"attr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.0-150000.4.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"acl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-150000.4.6.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"attr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.0-150000.4.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"acl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-150000.4.6.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"attr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.0-150000.4.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"acl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-150000.4.6.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"attr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.0-150000.4.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"acl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-150000.4.6.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"attr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.0-150000.4.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"acl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-150000.4.6.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"attr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.0-150000.4.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"acl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.52-1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"acl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.52-2","2.2.52-3"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"acl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.52-3build1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"acl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.53-4","2.2.53-5","2.2.53-5ubuntu1","2.2.53-6"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"acl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.53-10ubuntu2","2.3.1-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"acl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.3.1-3","2.3.1-4ubuntu1","2.3.2-1","2.3.2-1build1","2.3.2-1build1.1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"acl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.3.2-2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"acl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.3.2-2"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"acl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"acl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-160000.1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"attr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.0-160000.1.1"}]}],"bundled":3}],"products":[{"vendor":"acl project","product":"acl"},{"vendor":"red hat","product":"red hat discovery 2"},{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 10.0 extended update support"},{"vendor":"red hat","product":"red hat enterprise linux 6"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"red hat","product":"red hat hardened images"},{"vendor":"red hat","product":"red hat insights proxy 1.5"},{"vendor":"red hat","product":"red hat openshift container platform 4"},{"vendor":"red hat","product":"red hat openshift container platform 4.22"},{"vendor":"red hat","product":"red hat openshift distributed tracing 3.10.2"},{"vendor":"red hat","product":"red hat update infrastructure 5"}],"references":[{"url":"https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=3589787cd589b34bdd9265936e17190b6d3f17d1","tags":["patch","fix","report"]},{"url":"https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=24a227d0ab8576612194f8a56c2314389adc74a5","tags":["issue-tracking","report"]},{"url":"https://www.vulncheck.com/advisories/acl-symlink-traversal-privilege-escalation-via-libacl-functions","tags":["third-party-advisory","advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-54369","tags":["vdb-entry","x_refsource_REDHAT","report","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2490277","tags":["issue-tracking","x_refsource_REDHAT","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54369.json","tags":["x_sadp-csaf-vex","web","report"]},{"url":"https://access.redhat.com/errata/RHSA-2026:54769","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:64805","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:42739","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:67142","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:67144","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:67140","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:42736","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:43420","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:46836","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:34351","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:53371","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:50205","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:44481","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:58981","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54369","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-53ch-pxc8-6g72"},{"url":"https://access.redhat.com/security/cve/CVE-2026-54370","tags":["report"]},{"url":"https://bugzilla.redhat.com/2490277","tags":["report"]},{"url":"https://bugzilla.redhat.com/2490279","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-42736.html","tags":["advisory"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-42739.html","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2026-43420.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1784909800.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54370","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1784982822.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos-stream8els/CLSA-2026-1785151239.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos8.4els/CLSA-2026-1785151263.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos8.5els/CLSA-2026-1785151703.html","tags":["advisory"]},{"url":"https://savannah.nongnu.org/projects/acl/","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54369.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-54369","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0321.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35779","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2026/06/29/1","tags":["web","report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3TDUECPBS6YQPFZZ6RNXV3T5EFLLHQZS/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CGDSXLCG4AXTWFBAKM6XYUUYO6LZ7YXY/","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/NOOHLEV27XADU2EMOLPK2E6IY2TZKFKQ/","tags":["web"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3079","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_34351.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-54369","tags":["advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2490279","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-54370","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_42736.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_42739.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_43420.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_64805.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_67140.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_67142.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_67144.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:71656","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_71656.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:72819","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_72819.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:72820","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_72820.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:42736","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:42739","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:43420","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623670-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1268867","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54369","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54370","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54371","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623705-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623726-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264176-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-54369","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-54369","title":"acl \u003c 2.4.0 Symlink Traversal Privilege Escalation via libacl Functions","description":"acl before version 2.4.0 contains a symlink traversal vulnerability in the libacl pathname-based functions acl_get_file(), acl_set_file(), acl_extended_file(), and acl_delete_def_file() that allows local attackers to escalate privileges by replacing any pathname component with a symbolic link. Attackers who control any component of a pathname processed by a privileged caller can redirect ACL read or write operations to arbitrary files or directories, enabling unauthorized manipulation of access control lists and local privilege escalation.","status":"published","published":"2026-06-29T12:37:21.666Z","modified":"2026-09-14T12:04:32.121Z","cvss":[{"version":"4.0","score":8.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high","assessor":"cna"},{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"cna"},{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"adp"}],"cwes":["CWE-59","CWE-59"],"updated_at":"2026-11-02T13:38:09.774038Z"}],"euvd":[{"id":"EUVD-2026-40085","description":"acl before version 2.4.0 contains a symlink traversal vulnerability in the libacl pathname-based functions acl_get_file(), acl_set_file(), acl_extended_file(), and acl_delete_def_file() that allows local attackers to escalate privileges by replacing any pathname component with a symbolic link. Attackers who control any component of a pathname processed by a privileged caller can redirect ACL read or write operations to arbitrary files or directories, enabling unauthorized manipulation of access control lists and local privilege escalation.","status":"published","published":"2026-06-29T12:37:21Z","modified":"2026-09-14T12:04:32Z","cvss":[{"version":"4.0","score":8.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T17:28:21.2136Z"}],"ghsa":[{"id":"GHSA-53ch-pxc8-6g72","title":"acl before version 2.4.0 contains a symlink traversal vulnerability in the libacl pathname-based...","description":"acl before version 2.4.0 contains a symlink traversal vulnerability in the libacl pathname-based functions acl_get_file(), acl_set_file(), acl_extended_file(), and acl_delete_def_file() that allows local attackers to escalate privileges by replacing any pathname component with a symbolic link. Attackers who control any component of a pathname processed by a privileged caller can redirect ACL read or write operations to arbitrary files or directories, enabling unauthorized manipulation of access control lists and local privilege escalation.","status":"published","published":"2026-06-29T15:32:06Z","modified":"2026-09-14T15:32:13Z","cvss":[{"version":"4.0","score":8.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"},{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-59"],"updated_at":"2026-11-02T15:11:49.397809Z"}],"nvd":[{"id":"CVE-2026-54369","description":"acl before version 2.4.0 contains a symlink traversal vulnerability in the libacl pathname-based functions acl_get_file(), acl_set_file(), acl_extended_file(), and acl_delete_def_file() that allows local attackers to escalate privileges by replacing any pathname component with a symbolic link. Attackers who control any component of a pathname processed by a privileged caller can redirect ACL read or write operations to arbitrary files or directories, enabling unauthorized manipulation of access control lists and local privilege escalation.","status":"published","published":"2026-06-29T14:16:57.487Z","modified":"2026-10-25T21:10:00.77Z","cvss":[{"version":"4.0","score":8.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"secondary"},{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-59"],"updated_at":"2026-11-02T14:12:26.508751Z"}],"osv":[{"id":"CVE-2026-54369","title":"acl \u003c 2.4.0 Symlink Traversal Privilege Escalation via libacl Functions","description":"acl before version 2.4.0 contains a symlink traversal vulnerability in the libacl pathname-based functions acl_get_file(), acl_set_file(), acl_extended_file(), and acl_delete_def_file() that allows local attackers to escalate privileges by replacing any pathname component with a symbolic link. Attackers who control any component of a pathname processed by a privileged caller can redirect ACL read or write operations to arbitrary files or directories, enabling unauthorized manipulation of access control lists and local privilege escalation.","status":"published","published":"2026-06-29T12:37:21.666Z","modified":"2026-10-31T10:30:56.942472907Z","cvss":[{"version":"4.0","score":8.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-59"],"updated_at":"2026-11-02T15:45:10.818486Z"},{"id":"DEBIAN-CVE-2026-54369","description":"acl before version 2.4.0 contains a symlink traversal vulnerability in the libacl pathname-based functions acl_get_file(), acl_set_file(), acl_extended_file(), and acl_delete_def_file() that allows local attackers to escalate privileges by replacing any pathname component with a symbolic link. Attackers who control any component of a pathname processed by a privileged caller can redirect ACL read or write operations to arbitrary files or directories, enabling unauthorized manipulation of access control lists and local privilege escalation.","status":"published","published":"2026-06-29T14:16:57.487Z","modified":"2026-10-26T11:47:39.336837067Z","cvss":[{"version":"4.0","score":8.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"updated_at":"2026-11-02T15:45:57.236551Z"},{"id":"OESA-2026-3079","title":"acl security update","description":"This package contains commands for manipulating POSIX access control lists, and the libacl.so dynamic library which contains the POSIX 1003.1e draft standard 17 functions for manipulating access control lists.\r\n\r\nSecurity Fix(es):\n\nacl before version 2.4.0 contains a symlink traversal vulnerability in the libacl pathname-based functions acl_get_file(), acl_set_file(), acl_extended_file(), and acl_delete_def_file() that allows local attackers to escalate privileges by replacing any pathname component with a symbolic link. Attackers who control any component of a pathname processed by a privileged caller can redirect ACL read or write operations to arbitrary files or directories, enabling unauthorized manipulation of access control lists and local privilege escalation.(CVE-2026-54369)\n\nacl before version 2.4.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability that allows local attackers to escalate privileges by replacing a pathname component with a symbolic link between an lstat() check and subsequent symlink-following operations such as stat(), chown(), chmod(), acl_get_file(), and acl_set_file(). Attackers who control a pathname component can redirect file access control list operations to arbitrary files when getfacl, setfacl, or chacl is invoked by a privileged process over an attacker-controlled path, resulting in local privilege escalation.(CVE-2026-54370)","status":"published","published":"2026-07-19T11:11:58Z","modified":"2026-08-18T01:21:20.308318473Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"RHSA-2026:34351","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","status":"published","published":"2026-07-02T10:17:37Z","modified":"2026-10-16T10:15:59Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:19.963895Z"},{"id":"RHSA-2026:42736","title":"Red Hat Security Advisory: acl security update","status":"published","published":"2026-07-23T10:14:12Z","modified":"2026-10-16T10:17:55Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:20.491441Z"},{"id":"RHSA-2026:42739","title":"Red Hat Security Advisory: acl security update","status":"published","published":"2026-07-23T10:14:13Z","modified":"2026-10-16T10:17:55Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:20.491441Z"},{"id":"RHSA-2026:43420","title":"Red Hat Security Advisory: acl security update","status":"published","published":"2026-07-23T10:14:26Z","modified":"2026-10-16T10:18:01Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:20.491441Z"},{"id":"RHSA-2026:64805","title":"Red Hat Security Advisory: acl security update","status":"published","published":"2026-09-08T10:19:11Z","modified":"2026-10-16T10:22:25Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:21.91255Z"},{"id":"RHSA-2026:67140","title":"Red Hat Security Advisory: acl security update","status":"published","published":"2026-09-15T10:16:47Z","modified":"2026-10-16T10:22:57Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"RHSA-2026:67142","title":"Red Hat Security Advisory: acl security update","status":"published","published":"2026-09-14T10:10:14Z","modified":"2026-10-16T10:22:58Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"RHSA-2026:67144","title":"Red Hat Security Advisory: acl security update","status":"published","published":"2026-09-14T10:10:14Z","modified":"2026-10-16T10:22:58Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"RHSA-2026:71656","title":"Red Hat Security Advisory: acl security update","status":"published","published":"2026-09-25T10:15:45Z","modified":"2026-10-16T10:24:44Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RHSA-2026:72819","title":"Red Hat Security Advisory: acl security update","status":"published","published":"2026-09-29T10:18:38Z","modified":"2026-10-16T10:25:03Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RHSA-2026:72820","title":"Red Hat Security Advisory: acl security update","status":"published","published":"2026-09-29T10:18:38Z","modified":"2026-10-16T10:25:04Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RLSA-2026:42736","title":"Important: acl security update","description":"Access Control Lists (ACLs) are used to define fine-grained discretionary access rights for files and directories. The acl packages contain the getfacl and setfacl utilities needed for manipulating access control lists.\n\nSecurity Fix(es):\n\n* acl: Symlink traversal privilege escalation via libacl functions (CVE-2026-54369)\n\n* acl: TOCTOU Symlink Traversal via getfacl/setfacl (CVE-2026-54370)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-07-22T12:03:41.8445Z","modified":"2026-07-22T12:30:07.066520967Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:26.111232Z"},{"id":"RLSA-2026:42739","title":"Important: acl security update","description":"Access Control Lists (ACLs) are used to define fine-grained discretionary access rights for files and directories. The acl packages contain the getfacl and setfacl utilities needed for manipulating access control lists.\n\nSecurity Fix(es):\n\n* acl: Symlink traversal privilege escalation via libacl functions (CVE-2026-54369)\n\n* acl: TOCTOU Symlink Traversal via getfacl/setfacl (CVE-2026-54370)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-07-22T12:05:54.42934Z","modified":"2026-07-22T12:30:07.017528033Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:26.111232Z"},{"id":"RLSA-2026:43420","title":"Important: acl security update","description":"Access Control Lists (ACLs) are used to define fine-grained discretionary access rights for files and directories. The acl packages contain the getfacl and setfacl utilities needed for manipulating access control lists.\n\nSecurity Fix(es):\n\n* acl: Symlink traversal privilege escalation via libacl functions (CVE-2026-54369)\n\n* acl: TOCTOU Symlink Traversal via getfacl/setfacl (CVE-2026-54370)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-07-23T06:01:03.884297Z","modified":"2026-07-23T06:30:06.726939662Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:26.111232Z"},{"id":"UBUNTU-CVE-2026-54369","description":"acl before version 2.4.0 contains a symlink traversal vulnerability in the libacl pathname-based functions acl_get_file(), acl_set_file(), acl_extended_file(), and acl_delete_def_file() that allows local attackers to escalate privileges by replacing any pathname component with a symbolic link. Attackers who control any component of a pathname processed by a privileged caller can redirect ACL read or write operations to arbitrary files or directories, enabling unauthorized manipulation of access control lists and local privilege escalation.","status":"published","published":"2026-06-29T14:16:00Z","modified":"2026-07-01T21:27:56Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"},{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"},{"version":"4.0","score":8.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T16:56:41.382716Z"},{"id":"ALSA-2026:42736","title":"Important: acl security update","description":"Access Control Lists (ACLs) are used to define fine-grained discretionary access rights for files and directories. The acl packages contain the getfacl and setfacl utilities needed for manipulating access control lists.  \n\nSecurity Fix(es):  \n\n  * acl: Symlink traversal privilege escalation via libacl functions (CVE-2026-54369)\n  * acl: TOCTOU Symlink Traversal via getfacl/setfacl (CVE-2026-54370)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-07-21T00:00:00Z","modified":"2026-10-29T11:32:35.820619155Z","updated_at":"2026-11-02T15:27:54.753319Z"},{"id":"ALSA-2026:42739","title":"Important: acl security update","description":"Access Control Lists (ACLs) are used to define fine-grained discretionary access rights for files and directories. The acl packages contain the getfacl and setfacl utilities needed for manipulating access control lists.  \n\nSecurity Fix(es):  \n\n  * acl: Symlink traversal privilege escalation via libacl functions (CVE-2026-54369)\n  * acl: TOCTOU Symlink Traversal via getfacl/setfacl (CVE-2026-54370)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-07-21T00:00:00Z","modified":"2026-10-29T11:30:36.294378986Z","updated_at":"2026-11-02T15:27:54.753319Z"},{"id":"ALSA-2026:43420","title":"Important: acl security update","description":"Access Control Lists (ACLs) are used to define fine-grained discretionary access rights for files and directories. The acl packages contain the getfacl and setfacl utilities needed for manipulating access control lists.  \n\nSecurity Fix(es):  \n\n  * acl: Symlink traversal privilege escalation via libacl functions (CVE-2026-54369)\n  * acl: TOCTOU Symlink Traversal via getfacl/setfacl (CVE-2026-54370)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-07-22T00:00:00Z","modified":"2026-10-29T11:02:24.718438316Z","updated_at":"2026-11-02T15:27:54.753319Z"},{"id":"AZL-91397","title":"CVE-2026-54369 affecting package acl for versions less than 2.4.0-1","description":"acl before version 2.4.0 contains a symlink traversal vulnerability in the libacl pathname-based functions acl_get_file(), acl_set_file(), acl_extended_file(), and acl_delete_def_file() that allows local attackers to escalate privileges by replacing any pathname component with a symbolic link. Attackers who control any component of a pathname processed by a privileged caller can redirect ACL read or write operations to arbitrary files or directories, enabling unauthorized manipulation of access control lists and local privilege escalation.","status":"published","published":"2026-06-29T14:16:57Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:25.633663Z"},{"id":"CLSA-2026-1784909800","title":"acl: Fix of 2 CVEs","description":"- rebase to 2.4.0 to fix CVE-2026-54369 and CVE-2026-54370","status":"published","published":"2026-07-28T08:44:41Z","modified":"2026-10-26T09:30:28.393771242Z","updated_at":"2026-11-02T15:43:46.482572Z"},{"id":"CLSA-2026-1784982822","title":"acl: Fix of 2 CVEs","description":"- rebase to 2.4.0 to fix CVE-2026-54369 and CVE-2026-54370","status":"published","published":"2026-07-28T09:09:10Z","modified":"2026-10-26T09:31:24.490556672Z","updated_at":"2026-11-02T15:43:46.482572Z"},{"id":"CLSA-2026-1785151239","title":"acl: Fix of 2 CVEs","description":"- rebase to 2.4.0 to fix CVE-2026-54369 and CVE-2026-54370","status":"published","published":"2026-07-28T08:38:39Z","modified":"2026-10-26T09:31:38.394453881Z","updated_at":"2026-11-02T15:43:46.482572Z"},{"id":"CLSA-2026-1785151263","title":"acl: Fix of 2 CVEs","description":"- rebase to 2.4.0 to fix CVE-2026-54369 and CVE-2026-54370","status":"published","published":"2026-07-28T08:50:26Z","modified":"2026-10-26T09:31:50.321346656Z","updated_at":"2026-11-02T15:43:46.482572Z"},{"id":"CLSA-2026-1785151703","title":"acl: Fix of 2 CVEs","description":"- rebase to 2.4.0 to fix CVE-2026-54369 and CVE-2026-54370","status":"published","published":"2026-07-28T08:54:17Z","modified":"2026-10-26T09:31:51.123207916Z","updated_at":"2026-11-02T15:43:46.482572Z"},{"id":"MGASA-2026-0321","title":"Updated acl attr packages fix security vulnerabilities","description":"The updated acl and attr packages fix security issues.\n","status":"published","published":"2026-08-04T17:15:44Z","modified":"2026-08-04T17:30:04.430702659Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:11312-1","title":"acl-2.4.0-1.1 on GA media","description":"These are all security issues fixed in the acl-2.4.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-07-20T00:00:00Z","modified":"2026-07-21T09:45:08.183172209Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"openSUSE-SU-2026:21832-1","title":"Security update for acl, attr","description":"This update for acl, attr fixes the following issue:\n\n- CVE-2026-54369,CVE-2026-54370,CVE-2026-54371: Symlink Traversal Privilege Escalation via getfattr/setfattr,\n  getfacl/setfacl/chacl, libacl (bsc#1268867).\n\nChanges for acl:\n\n- Update to 2.4.0 (jsc#PED-16501):\n Major Issues Fixed:\n - The libacl library functions acl_get_file(), acl_set_file(),\n acl_extended_file(), and acl_delete_def_file() take a pathname argument\n and follow symbolic links. When a privileged user calls one of those\n functions, an attacker that controls a pathname component can replace a\n file or directory with a symbolic link and redirect the operation to a\n different file. This can lead to local privilege escalation.\n (CVE-2026-54369, bsc#1268867)\n The library functions cannot be fixed without breaking compatibility; the\n described behaviour is by design.\n Instead, version 2.4.0 of the acl package introduces the additional\n functions acl_get_file_at(), acl_set_file_at(), acl_extended_file_at(), and\n acl_delete_def_file_at(). These functions each take a dirfd file\n descriptor argument and an at_flags argument and accept the\n AT_SYMLINK_NOFOLLOW and AT_EMPTY_PATH flags. Use these functions to\n control when to follow symbolic links. (CVE-2026-54370, bsc#1268867)\n In addition, the libacl functions acl_get_fd(), acl_set_fd(), and\n acl_extended_fd() functions always operate on the access ACL; the library\n previously did not offer a way to operate on the default ACL of a directory\n file descriptor. The new functions remove that restriction.\n It will be up to each individual program to start using these new library\n functions where appropriate.\n - When walking directory trees, the getfacl, setfacl, chacl, and getfattr\n utilities constructed the full pathname of each file in the tree and use that\n pathname to access the file. When a privileged user used those utilities,\n an attacker that controlled a pathname component could replace a directory with\n a symbolic link and redirect the operation to a different file, leading to\n a local privilege escalation. (CVE-2026-54371, bsc#1268867)\n This is fixed by using directory file descriptors and operating relative to\n those directory file descriptors.\n - When resolving the final pathname component, the getfacl, setfacl, chacl,\n getfattr, and setfattr utilities in some cases used functions that resolve\n symbolic links. This includes the above mentioned libacl functions, but\n also stat(), chmod(), and chown().\n This is fixed by using symlink-safe functions throughout the code.\n - When restoring a backup, the setfacl and setfattr utilities read the full\n pathnames of files from the backup. When those pathnames were resolved,\n pathname components that are symbolic links were traversed. An attacker\n that controlled a pathname component could replace it with a symbolic link,\n causing a privileged user to operate on a file other than the one intended.\n This could lead to the same kind of local privilege escalation as discussed\n before.\n This is fixed by using openat2(RESOLVE_NO_SYMLINKS) to resolve the\n directory components of a pathname, but see Compatibility Notes below for\n the details.\nMinor Issues Fixed:\n - When a symbolic link was specified on the command line but symbolic link\n traversal was disabled using option -P (--physical), the getfacl and\n setfacl utilities previously silently ignored the symlink. Now, an ELOOP\n (\"Too many levels of symbolic links\") error will result instead.\n - acl_delete_entry() now verifies that the specified entry belongs to the\n specified acl.\n - Numeric uids and gids that cannot be represented in types uid_t and gid_t\n are checked more carefully and invalid numbers are rejected.\n - Functions acl_get_file(), acl_get_file_at(), and acl_get_fd() will retry\n several times when the size of an ACL grows unexpectedly; previously, they\n only grew the allocated buffer once before giving up.\n - When passed a directory file descriptor, function perm_copy_fd() didn't\n copy the default ACL from one directory to the other. It now does.\n - setfacl --restore accidentally ignored leading whitespace in filenames. It\n no longer does.\n - setfacl --restore accidentally called chmod() when in --test mode. It no\n longer does.\n - When the setfattr --restore option was used multiple times, a buffer was\n accessed after being freed. This no longer happens.\n - When the setfattr -h (--no-dereference) option was given after --restore,\n it was ignored. Now, the options can be passed in any order.\n - The -h (--no-dereference) option of getfattr prevented getfattr from\n recursing into \"symbolic link directories\". This is wrong. When dirlink\n is a symbolic link that refers to a directory, \"getfattr -Rh dirlink\" will now\n visit that directory. The -P (--physical) option can be used to prevent\n that.\n - Similarly, when a symbolic link referring to a directory was specified on\n the getfacl or setfacl command line, the -R option did not cause that\n directory to be visited. This has been fixed so that those directories\n will now be visited. The -P (--physical) option can be used to prevent\n\nChanges for attr:\n\n- Update to 2.6.0 (jsc#PED-16501):\nMajor Issues Fixed:\n - The libacl library functions acl_get_file(), acl_set_file(),\n acl_extended_file(), and acl_delete_def_file() take a pathname argument\n and follow symbolic links. When a privileged user calls one of those\n functions, an attacker that controls a pathname component can replace a\n file or directory with a symbolic link and redirect the operation to a\n different file. This can lead to local privilege escalation.\n (CVE-2026-54369, bsc#1268867)\n The library functions cannot be fixed without breaking compatibility; the\n described behaviour is by design.\n Instead, version 2.4.0 of the acl package introduces the additional\n functions acl_get_file_at(), acl_set_file_at(), acl_extended_file_at(), and\n acl_delete_def_file_at(). These functions each take a dirfd file\n descriptor argument and an at_flags argument and accept the\n AT_SYMLINK_NOFOLLOW and AT_EMPTY_PATH flags. Use these functions to\n control when to follow symbolic links. (CVE-2026-54370, bsc#1268867)\n In addition, the libacl functions acl_get_fd(), acl_set_fd(), and\n acl_extended_fd() functions always operate on the access ACL; the library\n previously did not offer a way to operate on the default ACL of a directory\n file descriptor. The new functions remove that restriction.\n It will be up to each individual program to start using these new library\n functions where appropriate.\n - When walking directory trees, the getfacl, setfacl, chacl, and getfattr\n utilities constructed the full pathname of each file in the tree\nand use that\n pathname to access the file. When a privileged user used those utilities,\n an attacker that controlled a pathname component could replace a\ndirectory with\n a symbolic link and redirect the operation to a different file, leading to\n a local privilege escalation. (CVE-2026-54371, bsc#1268867)\n This is fixed by using directory file descriptors and operating relative to\n those directory file descriptors.\n - When resolving the final pathname component, the getfacl, setfacl, chacl,\n getfattr, and setfattr utilities in some cases used functions that resolve\n symbolic links. This includes the above mentioned libacl functions, but\n also stat(), chmod(), and chown().\n This is fixed by using symlink-safe functions throughout the code.\n - When restoring a backup, the setfacl and setfattr utilities read the full\n pathnames of files from the backup. When those pathnames were resolved,\n pathname components that are symbolic links were traversed. An attacker\n that controlled a pathname component could replace it with a symbolic link,\n causing a privileged user to operate on a file other than the one intended.\n This could lead to the same kind of local privilege escalation as discussed\n before.\n This is fixed by using openat2(RESOLVE_NO_SYMLINKS) to resolve the\n directory components of a pathname, but see Compatibility Notes below for\n the details.\nMinor Issues Fixed:\n - When a symbolic link was specified on the command line but symbolic link\n traversal was disabled using option -P (--physical), the getfacl and\n setfacl utilities previously silently ignored the symlink. Now, an ELOOP\n (\"Too many levels of symbolic links\") error will result instead.\n - acl_delete_entry() now verifies that the specified entry belongs to the\n specified acl.\n - Numeric uids and gids that cannot be represented in types uid_t and gid_t\n are checked more carefully and invalid numbers are rejected.\n - Functions acl_get_file(), acl_get_file_at(), and acl_get_fd() will retry\n several times when the size of an ACL grows unexpectedly; previously, they\n only grew the allocated buffer once before giving up.\n - When passed a directory file descriptor, function perm_copy_fd() didn't\n copy the default ACL from one directory to the other. It now does.\n - setfacl --restore accidentally ignored leading whitespace in filenames. It\n no longer does.\n - setfacl --restore accidentally called chmod() when in --test mode. It no\n longer does.\n - When the setfattr --restore option was used multiple times, a buffer was\n accessed after being freed. This no longer happens.\n - When the setfattr -h (--no-dereference) option was given after --restore,\n it was ignored. Now, the options can be passed in any order.\n - The -h (--no-dereference) option of getfattr prevented getfattr from\n recursing into \"symbolic link directories\". This is wrong. When dirlink\n is a symbolic link that refers to a directory, \"getfattr -Rh\ndirlink\" will now\n visit that directory. The -P (--physical) option can be used to prevent\n that.\n - Similarly, when a symbolic link referring to a directory was specified on\n the getfacl or setfacl command line, the -R option did not cause that\n directory to be visited. This has been fixed so that those directories\n will now be visited. The -P (--physical) option can be used to prevent\n","status":"published","published":"2026-09-11T11:45:57Z","modified":"2026-09-13T12:15:04.274076715Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"ROOT-OS-DEBIAN-11-CVE-2026-54369","title":"CVE-2026-54369 in acl - Patched by Root","description":"Root has patched CVE-2026-54369 in the acl package for Root:Debian:11. Multiple fixed versions available.","status":"published","published":"2026-08-20T12:01:14Z","modified":"2026-08-20T13:30:12.31435214Z","updated_at":"2026-11-02T15:53:30.44348Z"},{"id":"ROOT-OS-DEBIAN-12-CVE-2026-54369","title":"CVE-2026-54369 in acl - Patched by Root","description":"Root has patched CVE-2026-54369 in the acl package for Root:Debian:12. Multiple fixed versions available.","status":"published","published":"2026-08-25T08:21:25Z","modified":"2026-08-26T01:11:03.684155467Z","updated_at":"2026-11-02T15:53:32.298225Z"},{"id":"ROOT-OS-DEBIAN-13-CVE-2026-54369","title":"CVE-2026-54369 in acl - Patched by Root","description":"Root has patched CVE-2026-54369 in the acl package for Root:Debian:13. Multiple fixed versions available.","status":"published","published":"2026-08-24T06:39:26Z","modified":"2026-08-24T08:15:10.931757031Z","updated_at":"2026-11-02T15:53:33.681527Z"},{"id":"SUSE-SU-2026:23670-1","title":"Security update for acl, attr","description":"This update for acl, attr fixes the following issue:\n\n- CVE-2026-54369,CVE-2026-54370,CVE-2026-54371: Symlink Traversal Privilege Escalation via getfattr/setfattr,\n  getfacl/setfacl/chacl, libacl (bsc#1268867).\n\nChanges for acl:\n\n- Update to 2.4.0 (jsc#PED-16501):\n Major Issues Fixed:\n - The libacl library functions acl_get_file(), acl_set_file(),\n acl_extended_file(), and acl_delete_def_file() take a pathname argument\n and follow symbolic links. When a privileged user calls one of those\n functions, an attacker that controls a pathname component can replace a\n file or directory with a symbolic link and redirect the operation to a\n different file. This can lead to local privilege escalation.\n (CVE-2026-54369, bsc#1268867)\n The library functions cannot be fixed without breaking compatibility; the\n described behaviour is by design.\n Instead, version 2.4.0 of the acl package introduces the additional\n functions acl_get_file_at(), acl_set_file_at(), acl_extended_file_at(), and\n acl_delete_def_file_at(). These functions each take a dirfd file\n descriptor argument and an at_flags argument and accept the\n AT_SYMLINK_NOFOLLOW and AT_EMPTY_PATH flags. Use these functions to\n control when to follow symbolic links. (CVE-2026-54370, bsc#1268867)\n In addition, the libacl functions acl_get_fd(), acl_set_fd(), and\n acl_extended_fd() functions always operate on the access ACL; the library\n previously did not offer a way to operate on the default ACL of a directory\n file descriptor. The new functions remove that restriction.\n It will be up to each individual program to start using these new library\n functions where appropriate.\n - When walking directory trees, the getfacl, setfacl, chacl, and getfattr\n utilities constructed the full pathname of each file in the tree and use that\n pathname to access the file. When a privileged user used those utilities,\n an attacker that controlled a pathname component could replace a directory with\n a symbolic link and redirect the operation to a different file, leading to\n a local privilege escalation. (CVE-2026-54371, bsc#1268867)\n This is fixed by using directory file descriptors and operating relative to\n those directory file descriptors.\n - When resolving the final pathname component, the getfacl, setfacl, chacl,\n getfattr, and setfattr utilities in some cases used functions that resolve\n symbolic links. This includes the above mentioned libacl functions, but\n also stat(), chmod(), and chown().\n This is fixed by using symlink-safe functions throughout the code.\n - When restoring a backup, the setfacl and setfattr utilities read the full\n pathnames of files from the backup. When those pathnames were resolved,\n pathname components that are symbolic links were traversed. An attacker\n that controlled a pathname component could replace it with a symbolic link,\n causing a privileged user to operate on a file other than the one intended.\n This could lead to the same kind of local privilege escalation as discussed\n before.\n This is fixed by using openat2(RESOLVE_NO_SYMLINKS) to resolve the\n directory components of a pathname, but see Compatibility Notes below for\n the details.\nMinor Issues Fixed:\n - When a symbolic link was specified on the command line but symbolic link\n traversal was disabled using option -P (--physical), the getfacl and\n setfacl utilities previously silently ignored the symlink. Now, an ELOOP\n (\"Too many levels of symbolic links\") error will result instead.\n - acl_delete_entry() now verifies that the specified entry belongs to the\n specified acl.\n - Numeric uids and gids that cannot be represented in types uid_t and gid_t\n are checked more carefully and invalid numbers are rejected.\n - Functions acl_get_file(), acl_get_file_at(), and acl_get_fd() will retry\n several times when the size of an ACL grows unexpectedly; previously, they\n only grew the allocated buffer once before giving up.\n - When passed a directory file descriptor, function perm_copy_fd() didn't\n copy the default ACL from one directory to the other. It now does.\n - setfacl --restore accidentally ignored leading whitespace in filenames. It\n no longer does.\n - setfacl --restore accidentally called chmod() when in --test mode. It no\n longer does.\n - When the setfattr --restore option was used multiple times, a buffer was\n accessed after being freed. This no longer happens.\n - When the setfattr -h (--no-dereference) option was given after --restore,\n it was ignored. Now, the options can be passed in any order.\n - The -h (--no-dereference) option of getfattr prevented getfattr from\n recursing into \"symbolic link directories\". This is wrong. When dirlink\n is a symbolic link that refers to a directory, \"getfattr -Rh dirlink\" will now\n visit that directory. The -P (--physical) option can be used to prevent\n that.\n - Similarly, when a symbolic link referring to a directory was specified on\n the getfacl or setfacl command line, the -R option did not cause that\n directory to be visited. This has been fixed so that those directories\n will now be visited. The -P (--physical) option can be used to prevent\n\nChanges for attr:\n\n- Update to 2.6.0 (jsc#PED-16501):\nMajor Issues Fixed:\n - The libacl library functions acl_get_file(), acl_set_file(),\n acl_extended_file(), and acl_delete_def_file() take a pathname argument\n and follow symbolic links. When a privileged user calls one of those\n functions, an attacker that controls a pathname component can replace a\n file or directory with a symbolic link and redirect the operation to a\n different file. This can lead to local privilege escalation.\n (CVE-2026-54369, bsc#1268867)\n The library functions cannot be fixed without breaking compatibility; the\n described behaviour is by design.\n Instead, version 2.4.0 of the acl package introduces the additional\n functions acl_get_file_at(), acl_set_file_at(), acl_extended_file_at(), and\n acl_delete_def_file_at(). These functions each take a dirfd file\n descriptor argument and an at_flags argument and accept the\n AT_SYMLINK_NOFOLLOW and AT_EMPTY_PATH flags. Use these functions to\n control when to follow symbolic links. (CVE-2026-54370, bsc#1268867)\n In addition, the libacl functions acl_get_fd(), acl_set_fd(), and\n acl_extended_fd() functions always operate on the access ACL; the library\n previously did not offer a way to operate on the default ACL of a directory\n file descriptor. The new functions remove that restriction.\n It will be up to each individual program to start using these new library\n functions where appropriate.\n - When walking directory trees, the getfacl, setfacl, chacl, and getfattr\n utilities constructed the full pathname of each file in the tree\nand use that\n pathname to access the file. When a privileged user used those utilities,\n an attacker that controlled a pathname component could replace a\ndirectory with\n a symbolic link and redirect the operation to a different file, leading to\n a local privilege escalation. (CVE-2026-54371, bsc#1268867)\n This is fixed by using directory file descriptors and operating relative to\n those directory file descriptors.\n - When resolving the final pathname component, the getfacl, setfacl, chacl,\n getfattr, and setfattr utilities in some cases used functions that resolve\n symbolic links. This includes the above mentioned libacl functions, but\n also stat(), chmod(), and chown().\n This is fixed by using symlink-safe functions throughout the code.\n - When restoring a backup, the setfacl and setfattr utilities read the full\n pathnames of files from the backup. When those pathnames were resolved,\n pathname components that are symbolic links were traversed. An attacker\n that controlled a pathname component could replace it with a symbolic link,\n causing a privileged user to operate on a file other than the one intended.\n This could lead to the same kind of local privilege escalation as discussed\n before.\n This is fixed by using openat2(RESOLVE_NO_SYMLINKS) to resolve the\n directory components of a pathname, but see Compatibility Notes below for\n the details.\nMinor Issues Fixed:\n - When a symbolic link was specified on the command line but symbolic link\n traversal was disabled using option -P (--physical), the getfacl and\n setfacl utilities previously silently ignored the symlink. Now, an ELOOP\n (\"Too many levels of symbolic links\") error will result instead.\n - acl_delete_entry() now verifies that the specified entry belongs to the\n specified acl.\n - Numeric uids and gids that cannot be represented in types uid_t and gid_t\n are checked more carefully and invalid numbers are rejected.\n - Functions acl_get_file(), acl_get_file_at(), and acl_get_fd() will retry\n several times when the size of an ACL grows unexpectedly; previously, they\n only grew the allocated buffer once before giving up.\n - When passed a directory file descriptor, function perm_copy_fd() didn't\n copy the default ACL from one directory to the other. It now does.\n - setfacl --restore accidentally ignored leading whitespace in filenames. It\n no longer does.\n - setfacl --restore accidentally called chmod() when in --test mode. It no\n longer does.\n - When the setfattr --restore option was used multiple times, a buffer was\n accessed after being freed. This no longer happens.\n - When the setfattr -h (--no-dereference) option was given after --restore,\n it was ignored. Now, the options can be passed in any order.\n - The -h (--no-dereference) option of getfattr prevented getfattr from\n recursing into \"symbolic link directories\". This is wrong. When dirlink\n is a symbolic link that refers to a directory, \"getfattr -Rh\ndirlink\" will now\n visit that directory. The -P (--physical) option can be used to prevent\n that.\n - Similarly, when a symbolic link referring to a directory was specified on\n the getfacl or setfacl command line, the -R option did not cause that\n directory to be visited. This has been fixed so that those directories\n will now be visited. The -P (--physical) option can be used to prevent\n","status":"published","published":"2026-09-11T11:46:37Z","modified":"2026-09-29T18:23:11.287779363Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"SUSE-SU-2026:23705-1","title":"Security update for acl, attr","description":"This update for acl, attr fixes the following issue:\n\n- CVE-2026-54369,CVE-2026-54370,CVE-2026-54371: Symlink Traversal Privilege Escalation via getfattr/setfattr,\n  getfacl/setfacl/chacl, libacl (bsc#1268867).\n\nChanges for acl:\n\n- Update to 2.4.0 (jsc#PED-16501):\n Major Issues Fixed:\n - The libacl library functions acl_get_file(), acl_set_file(),\n acl_extended_file(), and acl_delete_def_file() take a pathname argument\n and follow symbolic links. When a privileged user calls one of those\n functions, an attacker that controls a pathname component can replace a\n file or directory with a symbolic link and redirect the operation to a\n different file. This can lead to local privilege escalation.\n (CVE-2026-54369, bsc#1268867)\n The library functions cannot be fixed without breaking compatibility; the\n described behaviour is by design.\n Instead, version 2.4.0 of the acl package introduces the additional\n functions acl_get_file_at(), acl_set_file_at(), acl_extended_file_at(), and\n acl_delete_def_file_at(). These functions each take a dirfd file\n descriptor argument and an at_flags argument and accept the\n AT_SYMLINK_NOFOLLOW and AT_EMPTY_PATH flags. Use these functions to\n control when to follow symbolic links. (CVE-2026-54370, bsc#1268867)\n In addition, the libacl functions acl_get_fd(), acl_set_fd(), and\n acl_extended_fd() functions always operate on the access ACL; the library\n previously did not offer a way to operate on the default ACL of a directory\n file descriptor. The new functions remove that restriction.\n It will be up to each individual program to start using these new library\n functions where appropriate.\n - When walking directory trees, the getfacl, setfacl, chacl, and getfattr\n utilities constructed the full pathname of each file in the tree and use that\n pathname to access the file. When a privileged user used those utilities,\n an attacker that controlled a pathname component could replace a directory with\n a symbolic link and redirect the operation to a different file, leading to\n a local privilege escalation. (CVE-2026-54371, bsc#1268867)\n This is fixed by using directory file descriptors and operating relative to\n those directory file descriptors.\n - When resolving the final pathname component, the getfacl, setfacl, chacl,\n getfattr, and setfattr utilities in some cases used functions that resolve\n symbolic links. This includes the above mentioned libacl functions, but\n also stat(), chmod(), and chown().\n This is fixed by using symlink-safe functions throughout the code.\n - When restoring a backup, the setfacl and setfattr utilities read the full\n pathnames of files from the backup. When those pathnames were resolved,\n pathname components that are symbolic links were traversed. An attacker\n that controlled a pathname component could replace it with a symbolic link,\n causing a privileged user to operate on a file other than the one intended.\n This could lead to the same kind of local privilege escalation as discussed\n before.\n This is fixed by using openat2(RESOLVE_NO_SYMLINKS) to resolve the\n directory components of a pathname, but see Compatibility Notes below for\n the details.\nMinor Issues Fixed:\n - When a symbolic link was specified on the command line but symbolic link\n traversal was disabled using option -P (--physical), the getfacl and\n setfacl utilities previously silently ignored the symlink. Now, an ELOOP\n (\"Too many levels of symbolic links\") error will result instead.\n - acl_delete_entry() now verifies that the specified entry belongs to the\n specified acl.\n - Numeric uids and gids that cannot be represented in types uid_t and gid_t\n are checked more carefully and invalid numbers are rejected.\n - Functions acl_get_file(), acl_get_file_at(), and acl_get_fd() will retry\n several times when the size of an ACL grows unexpectedly; previously, they\n only grew the allocated buffer once before giving up.\n - When passed a directory file descriptor, function perm_copy_fd() didn't\n copy the default ACL from one directory to the other. It now does.\n - setfacl --restore accidentally ignored leading whitespace in filenames. It\n no longer does.\n - setfacl --restore accidentally called chmod() when in --test mode. It no\n longer does.\n - When the setfattr --restore option was used multiple times, a buffer was\n accessed after being freed. This no longer happens.\n - When the setfattr -h (--no-dereference) option was given after --restore,\n it was ignored. Now, the options can be passed in any order.\n - The -h (--no-dereference) option of getfattr prevented getfattr from\n recursing into \"symbolic link directories\". This is wrong. When dirlink\n is a symbolic link that refers to a directory, \"getfattr -Rh dirlink\" will now\n visit that directory. The -P (--physical) option can be used to prevent\n that.\n - Similarly, when a symbolic link referring to a directory was specified on\n the getfacl or setfacl command line, the -R option did not cause that\n directory to be visited. This has been fixed so that those directories\n will now be visited. The -P (--physical) option can be used to prevent\n\nChanges for attr:\n\n- Update to 2.6.0 (jsc#PED-16501):\nMajor Issues Fixed:\n - The libacl library functions acl_get_file(), acl_set_file(),\n acl_extended_file(), and acl_delete_def_file() take a pathname argument\n and follow symbolic links. When a privileged user calls one of those\n functions, an attacker that controls a pathname component can replace a\n file or directory with a symbolic link and redirect the operation to a\n different file. This can lead to local privilege escalation.\n (CVE-2026-54369, bsc#1268867)\n The library functions cannot be fixed without breaking compatibility; the\n described behaviour is by design.\n Instead, version 2.4.0 of the acl package introduces the additional\n functions acl_get_file_at(), acl_set_file_at(), acl_extended_file_at(), and\n acl_delete_def_file_at(). These functions each take a dirfd file\n descriptor argument and an at_flags argument and accept the\n AT_SYMLINK_NOFOLLOW and AT_EMPTY_PATH flags. Use these functions to\n control when to follow symbolic links. (CVE-2026-54370, bsc#1268867)\n In addition, the libacl functions acl_get_fd(), acl_set_fd(), and\n acl_extended_fd() functions always operate on the access ACL; the library\n previously did not offer a way to operate on the default ACL of a directory\n file descriptor. The new functions remove that restriction.\n It will be up to each individual program to start using these new library\n functions where appropriate.\n - When walking directory trees, the getfacl, setfacl, chacl, and getfattr\n utilities constructed the full pathname of each file in the tree\nand use that\n pathname to access the file. When a privileged user used those utilities,\n an attacker that controlled a pathname component could replace a\ndirectory with\n a symbolic link and redirect the operation to a different file, leading to\n a local privilege escalation. (CVE-2026-54371, bsc#1268867)\n This is fixed by using directory file descriptors and operating relative to\n those directory file descriptors.\n - When resolving the final pathname component, the getfacl, setfacl, chacl,\n getfattr, and setfattr utilities in some cases used functions that resolve\n symbolic links. This includes the above mentioned libacl functions, but\n also stat(), chmod(), and chown().\n This is fixed by using symlink-safe functions throughout the code.\n - When restoring a backup, the setfacl and setfattr utilities read the full\n pathnames of files from the backup. When those pathnames were resolved,\n pathname components that are symbolic links were traversed. An attacker\n that controlled a pathname component could replace it with a symbolic link,\n causing a privileged user to operate on a file other than the one intended.\n This could lead to the same kind of local privilege escalation as discussed\n before.\n This is fixed by using openat2(RESOLVE_NO_SYMLINKS) to resolve the\n directory components of a pathname, but see Compatibility Notes below for\n the details.\nMinor Issues Fixed:\n - When a symbolic link was specified on the command line but symbolic link\n traversal was disabled using option -P (--physical), the getfacl and\n setfacl utilities previously silently ignored the symlink. Now, an ELOOP\n (\"Too many levels of symbolic links\") error will result instead.\n - acl_delete_entry() now verifies that the specified entry belongs to the\n specified acl.\n - Numeric uids and gids that cannot be represented in types uid_t and gid_t\n are checked more carefully and invalid numbers are rejected.\n - Functions acl_get_file(), acl_get_file_at(), and acl_get_fd() will retry\n several times when the size of an ACL grows unexpectedly; previously, they\n only grew the allocated buffer once before giving up.\n - When passed a directory file descriptor, function perm_copy_fd() didn't\n copy the default ACL from one directory to the other. It now does.\n - setfacl --restore accidentally ignored leading whitespace in filenames. It\n no longer does.\n - setfacl --restore accidentally called chmod() when in --test mode. It no\n longer does.\n - When the setfattr --restore option was used multiple times, a buffer was\n accessed after being freed. This no longer happens.\n - When the setfattr -h (--no-dereference) option was given after --restore,\n it was ignored. Now, the options can be passed in any order.\n - The -h (--no-dereference) option of getfattr prevented getfattr from\n recursing into \"symbolic link directories\". This is wrong. When dirlink\n is a symbolic link that refers to a directory, \"getfattr -Rh\ndirlink\" will now\n visit that directory. The -P (--physical) option can be used to prevent\n that.\n - Similarly, when a symbolic link referring to a directory was specified on\n the getfacl or setfacl command line, the -R option did not cause that\n directory to be visited. This has been fixed so that those directories\n will now be visited. The -P (--physical) option can be used to prevent\n","status":"published","published":"2026-09-11T11:46:37Z","modified":"2026-09-29T18:23:21.320522192Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"SUSE-SU-2026:23726-1","title":"Security update for acl, attr","description":"This update for acl, attr fixes the following issue:\n\n- CVE-2026-54369,CVE-2026-54370,CVE-2026-54371: Symlink Traversal Privilege Escalation via getfattr/setfattr,\n  getfacl/setfacl/chacl, libacl (bsc#1268867).\n\nChanges for acl:\n\n- Update to 2.4.0 (jsc#PED-16501):\n Major Issues Fixed:\n - The libacl library functions acl_get_file(), acl_set_file(),\n acl_extended_file(), and acl_delete_def_file() take a pathname argument\n and follow symbolic links. When a privileged user calls one of those\n functions, an attacker that controls a pathname component can replace a\n file or directory with a symbolic link and redirect the operation to a\n different file. This can lead to local privilege escalation.\n (CVE-2026-54369, bsc#1268867)\n The library functions cannot be fixed without breaking compatibility; the\n described behaviour is by design.\n Instead, version 2.4.0 of the acl package introduces the additional\n functions acl_get_file_at(), acl_set_file_at(), acl_extended_file_at(), and\n acl_delete_def_file_at(). These functions each take a dirfd file\n descriptor argument and an at_flags argument and accept the\n AT_SYMLINK_NOFOLLOW and AT_EMPTY_PATH flags. Use these functions to\n control when to follow symbolic links. (CVE-2026-54370, bsc#1268867)\n In addition, the libacl functions acl_get_fd(), acl_set_fd(), and\n acl_extended_fd() functions always operate on the access ACL; the library\n previously did not offer a way to operate on the default ACL of a directory\n file descriptor. The new functions remove that restriction.\n It will be up to each individual program to start using these new library\n functions where appropriate.\n - When walking directory trees, the getfacl, setfacl, chacl, and getfattr\n utilities constructed the full pathname of each file in the tree and use that\n pathname to access the file. When a privileged user used those utilities,\n an attacker that controlled a pathname component could replace a directory with\n a symbolic link and redirect the operation to a different file, leading to\n a local privilege escalation. (CVE-2026-54371, bsc#1268867)\n This is fixed by using directory file descriptors and operating relative to\n those directory file descriptors.\n - When resolving the final pathname component, the getfacl, setfacl, chacl,\n getfattr, and setfattr utilities in some cases used functions that resolve\n symbolic links. This includes the above mentioned libacl functions, but\n also stat(), chmod(), and chown().\n This is fixed by using symlink-safe functions throughout the code.\n - When restoring a backup, the setfacl and setfattr utilities read the full\n pathnames of files from the backup. When those pathnames were resolved,\n pathname components that are symbolic links were traversed. An attacker\n that controlled a pathname component could replace it with a symbolic link,\n causing a privileged user to operate on a file other than the one intended.\n This could lead to the same kind of local privilege escalation as discussed\n before.\n This is fixed by using openat2(RESOLVE_NO_SYMLINKS) to resolve the\n directory components of a pathname, but see Compatibility Notes below for\n the details.\nMinor Issues Fixed:\n - When a symbolic link was specified on the command line but symbolic link\n traversal was disabled using option -P (--physical), the getfacl and\n setfacl utilities previously silently ignored the symlink. Now, an ELOOP\n (\"Too many levels of symbolic links\") error will result instead.\n - acl_delete_entry() now verifies that the specified entry belongs to the\n specified acl.\n - Numeric uids and gids that cannot be represented in types uid_t and gid_t\n are checked more carefully and invalid numbers are rejected.\n - Functions acl_get_file(), acl_get_file_at(), and acl_get_fd() will retry\n several times when the size of an ACL grows unexpectedly; previously, they\n only grew the allocated buffer once before giving up.\n - When passed a directory file descriptor, function perm_copy_fd() didn't\n copy the default ACL from one directory to the other. It now does.\n - setfacl --restore accidentally ignored leading whitespace in filenames. It\n no longer does.\n - setfacl --restore accidentally called chmod() when in --test mode. It no\n longer does.\n - When the setfattr --restore option was used multiple times, a buffer was\n accessed after being freed. This no longer happens.\n - When the setfattr -h (--no-dereference) option was given after --restore,\n it was ignored. Now, the options can be passed in any order.\n - The -h (--no-dereference) option of getfattr prevented getfattr from\n recursing into \"symbolic link directories\". This is wrong. When dirlink\n is a symbolic link that refers to a directory, \"getfattr -Rh dirlink\" will now\n visit that directory. The -P (--physical) option can be used to prevent\n that.\n - Similarly, when a symbolic link referring to a directory was specified on\n the getfacl or setfacl command line, the -R option did not cause that\n directory to be visited. This has been fixed so that those directories\n will now be visited. The -P (--physical) option can be used to prevent\n\nChanges for attr:\n\n- Update to 2.6.0 (jsc#PED-16501):\nMajor Issues Fixed:\n - The libacl library functions acl_get_file(), acl_set_file(),\n acl_extended_file(), and acl_delete_def_file() take a pathname argument\n and follow symbolic links. When a privileged user calls one of those\n functions, an attacker that controls a pathname component can replace a\n file or directory with a symbolic link and redirect the operation to a\n different file. This can lead to local privilege escalation.\n (CVE-2026-54369, bsc#1268867)\n The library functions cannot be fixed without breaking compatibility; the\n described behaviour is by design.\n Instead, version 2.4.0 of the acl package introduces the additional\n functions acl_get_file_at(), acl_set_file_at(), acl_extended_file_at(), and\n acl_delete_def_file_at(). These functions each take a dirfd file\n descriptor argument and an at_flags argument and accept the\n AT_SYMLINK_NOFOLLOW and AT_EMPTY_PATH flags. Use these functions to\n control when to follow symbolic links. (CVE-2026-54370, bsc#1268867)\n In addition, the libacl functions acl_get_fd(), acl_set_fd(), and\n acl_extended_fd() functions always operate on the access ACL; the library\n previously did not offer a way to operate on the default ACL of a directory\n file descriptor. The new functions remove that restriction.\n It will be up to each individual program to start using these new library\n functions where appropriate.\n - When walking directory trees, the getfacl, setfacl, chacl, and getfattr\n utilities constructed the full pathname of each file in the tree\nand use that\n pathname to access the file. When a privileged user used those utilities,\n an attacker that controlled a pathname component could replace a\ndirectory with\n a symbolic link and redirect the operation to a different file, leading to\n a local privilege escalation. (CVE-2026-54371, bsc#1268867)\n This is fixed by using directory file descriptors and operating relative to\n those directory file descriptors.\n - When resolving the final pathname component, the getfacl, setfacl, chacl,\n getfattr, and setfattr utilities in some cases used functions that resolve\n symbolic links. This includes the above mentioned libacl functions, but\n also stat(), chmod(), and chown().\n This is fixed by using symlink-safe functions throughout the code.\n - When restoring a backup, the setfacl and setfattr utilities read the full\n pathnames of files from the backup. When those pathnames were resolved,\n pathname components that are symbolic links were traversed. An attacker\n that controlled a pathname component could replace it with a symbolic link,\n causing a privileged user to operate on a file other than the one intended.\n This could lead to the same kind of local privilege escalation as discussed\n before.\n This is fixed by using openat2(RESOLVE_NO_SYMLINKS) to resolve the\n directory components of a pathname, but see Compatibility Notes below for\n the details.\nMinor Issues Fixed:\n - When a symbolic link was specified on the command line but symbolic link\n traversal was disabled using option -P (--physical), the getfacl and\n setfacl utilities previously silently ignored the symlink. Now, an ELOOP\n (\"Too many levels of symbolic links\") error will result instead.\n - acl_delete_entry() now verifies that the specified entry belongs to the\n specified acl.\n - Numeric uids and gids that cannot be represented in types uid_t and gid_t\n are checked more carefully and invalid numbers are rejected.\n - Functions acl_get_file(), acl_get_file_at(), and acl_get_fd() will retry\n several times when the size of an ACL grows unexpectedly; previously, they\n only grew the allocated buffer once before giving up.\n - When passed a directory file descriptor, function perm_copy_fd() didn't\n copy the default ACL from one directory to the other. It now does.\n - setfacl --restore accidentally ignored leading whitespace in filenames. It\n no longer does.\n - setfacl --restore accidentally called chmod() when in --test mode. It no\n longer does.\n - When the setfattr --restore option was used multiple times, a buffer was\n accessed after being freed. This no longer happens.\n - When the setfattr -h (--no-dereference) option was given after --restore,\n it was ignored. Now, the options can be passed in any order.\n - The -h (--no-dereference) option of getfattr prevented getfattr from\n recursing into \"symbolic link directories\". This is wrong. When dirlink\n is a symbolic link that refers to a directory, \"getfattr -Rh\ndirlink\" will now\n visit that directory. The -P (--physical) option can be used to prevent\n that.\n - Similarly, when a symbolic link referring to a directory was specified on\n the getfacl or setfacl command line, the -R option did not cause that\n directory to be visited. This has been fixed so that those directories\n will now be visited. The -P (--physical) option can be used to prevent\n","status":"published","published":"2026-09-11T11:46:37Z","modified":"2026-09-29T18:23:21.805931342Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"SUSE-SU-2026:4176-1","title":"Security update for acl, attr","description":"This update for acl, attr fixes the following issue:\n\n- CVE-2026-54369,CVE-2026-54370,CVE-2026-54371: Symlink Traversal Privilege Escalation via getfattr/setfattr,\n  getfacl/setfacl/chacl, libacl (bsc#1268867).\n\nChanges for acl:\n\n- Update to 2.4.0 (jsc#PED-16501):\n Major Issues Fixed:\n - The libacl library functions acl_get_file(), acl_set_file(),\n acl_extended_file(), and acl_delete_def_file() take a pathname argument\n and follow symbolic links. When a privileged user calls one of those\n functions, an attacker that controls a pathname component can replace a\n file or directory with a symbolic link and redirect the operation to a\n different file. This can lead to local privilege escalation.\n (CVE-2026-54369, bsc#1268867)\n The library functions cannot be fixed without breaking compatibility; the\n described behaviour is by design.\n Instead, version 2.4.0 of the acl package introduces the additional\n functions acl_get_file_at(), acl_set_file_at(), acl_extended_file_at(), and\n acl_delete_def_file_at(). These functions each take a dirfd file\n descriptor argument and an at_flags argument and accept the\n AT_SYMLINK_NOFOLLOW and AT_EMPTY_PATH flags. Use these functions to\n control when to follow symbolic links. (CVE-2026-54370, bsc#1268867)\n In addition, the libacl functions acl_get_fd(), acl_set_fd(), and\n acl_extended_fd() functions always operate on the access ACL; the library\n previously did not offer a way to operate on the default ACL of a directory\n file descriptor. The new functions remove that restriction.\n It will be up to each individual program to start using these new library\n functions where appropriate.\n - When walking directory trees, the getfacl, setfacl, chacl, and getfattr\n utilities constructed the full pathname of each file in the tree and use that\n pathname to access the file. When a privileged user used those utilities,\n an attacker that controlled a pathname component could replace a directory with\n a symbolic link and redirect the operation to a different file, leading to\n a local privilege escalation. (CVE-2026-54371, bsc#1268867)\n This is fixed by using directory file descriptors and operating relative to\n those directory file descriptors.\n - When resolving the final pathname component, the getfacl, setfacl, chacl,\n getfattr, and setfattr utilities in some cases used functions that resolve\n symbolic links. This includes the above mentioned libacl functions, but\n also stat(), chmod(), and chown().\n This is fixed by using symlink-safe functions throughout the code.\n - When restoring a backup, the setfacl and setfattr utilities read the full\n pathnames of files from the backup. When those pathnames were resolved,\n pathname components that are symbolic links were traversed. An attacker\n that controlled a pathname component could replace it with a symbolic link,\n causing a privileged user to operate on a file other than the one intended.\n This could lead to the same kind of local privilege escalation as discussed\n before.\n This is fixed by using openat2(RESOLVE_NO_SYMLINKS) to resolve the\n directory components of a pathname, but see Compatibility Notes below for\n the details.\nMinor Issues Fixed:\n - When a symbolic link was specified on the command line but symbolic link\n traversal was disabled using option -P (--physical), the getfacl and\n setfacl utilities previously silently ignored the symlink. Now, an ELOOP\n ('Too many levels of symbolic links') error will result instead.\n - acl_delete_entry() now verifies that the specified entry belongs to the\n specified acl.\n - Numeric uids and gids that cannot be represented in types uid_t and gid_t\n are checked more carefully and invalid numbers are rejected.\n - Functions acl_get_file(), acl_get_file_at(), and acl_get_fd() will retry\n several times when the size of an ACL grows unexpectedly; previously, they\n only grew the allocated buffer once before giving up.\n - When passed a directory file descriptor, function perm_copy_fd() didn't\n copy the default ACL from one directory to the other. It now does.\n - setfacl --restore accidentally ignored leading whitespace in filenames. It\n no longer does.\n - setfacl --restore accidentally called chmod() when in --test mode. It no\n longer does.\n - When the setfattr --restore option was used multiple times, a buffer was\n accessed after being freed. This no longer happens.\n - When the setfattr -h (--no-dereference) option was given after --restore,\n it was ignored. Now, the options can be passed in any order.\n - The -h (--no-dereference) option of getfattr prevented getfattr from\n recursing into 'symbolic link directories'. This is wrong. When dirlink\n is a symbolic link that refers to a directory, 'getfattr -Rh dirlink' will now\n visit that directory. The -P (--physical) option can be used to prevent\n that.\n - Similarly, when a symbolic link referring to a directory was specified on\n the getfacl or setfacl command line, the -R option did not cause that\n directory to be visited. This has been fixed so that those directories\n will now be visited. The -P (--physical) option can be used to prevent\n\nChanges for attr:\n\n- Update to 2.6.0 (jsc#PED-16501):\nMajor Issues Fixed:\n - The libacl library functions acl_get_file(), acl_set_file(),\n acl_extended_file(), and acl_delete_def_file() take a pathname argument\n and follow symbolic links. When a privileged user calls one of those\n functions, an attacker that controls a pathname component can replace a\n file or directory with a symbolic link and redirect the operation to a\n different file. This can lead to local privilege escalation.\n (CVE-2026-54369, bsc#1268867)\n The library functions cannot be fixed without breaking compatibility; the\n described behaviour is by design.\n Instead, version 2.4.0 of the acl package introduces the additional\n functions acl_get_file_at(), acl_set_file_at(), acl_extended_file_at(), and\n acl_delete_def_file_at(). These functions each take a dirfd file\n descriptor argument and an at_flags argument and accept the\n AT_SYMLINK_NOFOLLOW and AT_EMPTY_PATH flags. Use these functions to\n control when to follow symbolic links. (CVE-2026-54370, bsc#1268867)\n In addition, the libacl functions acl_get_fd(), acl_set_fd(), and\n acl_extended_fd() functions always operate on the access ACL; the library\n previously did not offer a way to operate on the default ACL of a directory\n file descriptor. The new functions remove that restriction.\n It will be up to each individual program to start using these new library\n functions where appropriate.\n - When walking directory trees, the getfacl, setfacl, chacl, and getfattr\n utilities constructed the full pathname of each file in the tree\nand use that\n pathname to access the file. When a privileged user used those utilities,\n an attacker that controlled a pathname component could replace a\ndirectory with\n a symbolic link and redirect the operation to a different file, leading to\n a local privilege escalation. (CVE-2026-54371, bsc#1268867)\n This is fixed by using directory file descriptors and operating relative to\n those directory file descriptors.\n - When resolving the final pathname component, the getfacl, setfacl, chacl,\n getfattr, and setfattr utilities in some cases used functions that resolve\n symbolic links. This includes the above mentioned libacl functions, but\n also stat(), chmod(), and chown().\n This is fixed by using symlink-safe functions throughout the code.\n - When restoring a backup, the setfacl and setfattr utilities read the full\n pathnames of files from the backup. When those pathnames were resolved,\n pathname components that are symbolic links were traversed. An attacker\n that controlled a pathname component could replace it with a symbolic link,\n causing a privileged user to operate on a file other than the one intended.\n This could lead to the same kind of local privilege escalation as discussed\n before.\n This is fixed by using openat2(RESOLVE_NO_SYMLINKS) to resolve the\n directory components of a pathname, but see Compatibility Notes below for\n the details.\nMinor Issues Fixed:\n - When a symbolic link was specified on the command line but symbolic link\n traversal was disabled using option -P (--physical), the getfacl and\n setfacl utilities previously silently ignored the symlink. Now, an ELOOP\n ('Too many levels of symbolic links') error will result instead.\n - acl_delete_entry() now verifies that the specified entry belongs to the\n specified acl.\n - Numeric uids and gids that cannot be represented in types uid_t and gid_t\n are checked more carefully and invalid numbers are rejected.\n - Functions acl_get_file(), acl_get_file_at(), and acl_get_fd() will retry\n several times when the size of an ACL grows unexpectedly; previously, they\n only grew the allocated buffer once before giving up.\n - When passed a directory file descriptor, function perm_copy_fd() didn't\n copy the default ACL from one directory to the other. It now does.\n - setfacl --restore accidentally ignored leading whitespace in filenames. It\n no longer does.\n - setfacl --restore accidentally called chmod() when in --test mode. It no\n longer does.\n - When the setfattr --restore option was used multiple times, a buffer was\n accessed after being freed. This no longer happens.\n - When the setfattr -h (--no-dereference) option was given after --restore,\n it was ignored. Now, the options can be passed in any order.\n - The -h (--no-dereference) option of getfattr prevented getfattr from\n recursing into 'symbolic link directories'. This is wrong. When dirlink\n is a symbolic link that refers to a directory, 'getfattr -Rh\ndirlink' will now\n visit that directory. The -P (--physical) option can be used to prevent\n that.\n - Similarly, when a symbolic link referring to a directory was specified on\n the getfacl or setfacl command line, the -R option did not cause that\n directory to be visited. This has been fixed so that those directories\n will now be visited. The -P (--physical) option can be used to prevent\n- update to 2.5.2:\n * attr: eliminate a dead store in attr_copy_action()\n * libattr: Set symbol versions for legacy syscalls via attribute\n or asm\n * exports: use LGPL for library code\n * documentation updates\n * translation updates (Polish, Dutch, Gregorian, French)\n * build system updates\n","status":"published","published":"2026-09-14T10:30:55Z","modified":"2026-09-15T17:00:05.449538893Z","updated_at":"2026-11-02T15:54:05.392906Z"}]}}