{"id":"CVE-2026-54371","aliases":["ALSA-2026:56133","ALSA-2026:59380","ALSA-2026:60226","AZL-91400","AZL-91424","CLSA-2026-1785346928","CLSA-2026-1785347213","CLSA-2026-1787146803","CLSA-2026-1787148007","DEBIAN-CVE-2026-54371","EUVD-2026-40087","GHSA-hh95-r7mj-c9j5","MGASA-2026-0321","OESA-2026-2913","OESA-2026-2914","OESA-2026-2915","OESA-2026-2916","OESA-2026-3080","RHSA-2026:34889","RHSA-2026:56133","RHSA-2026:59380","RHSA-2026:60226","RLSA-2026:56133","RLSA-2026:59380","RLSA-2026:60226","ROOT-OS-DEBIAN-11-CVE-2026-54371","ROOT-OS-DEBIAN-12-CVE-2026-54371","ROOT-OS-DEBIAN-13-CVE-2026-54371","SUSE-SU-2026:23670-1","SUSE-SU-2026:23705-1","SUSE-SU-2026:23726-1","SUSE-SU-2026:4176-1","UBUNTU-CVE-2026-54371","USN-8691-1","openSUSE-SU-2026:11312-1","openSUSE-SU-2026:21832-1"],"status":"published","title":"attr \u003c 2.6.0 Symlink Traversal Privilege Escalation via getfattr/setfattr","description":"attr before version 2.6.0 contains a symlink traversal vulnerability in the getfattr and setfattr utilities that allows local attackers to escalate privileges by replacing a pathname component with a symbolic link during directory hierarchy traversal. Attackers who control a pathname component can redirect getfattr and setfattr operations to arbitrary files by substituting a symlink, leading to local privilege escalation when getfattr or setfattr is invoked by a privileged process over an attacker-controlled path.","severity":{"version":"4.0","score":8.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00146,"percentile":0.03862,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-59"],"published":"2026-06-29T12:39:23Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"AlmaLinux:8","package":"attr","fixed_in":["2.6.0-1.el8_10"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"libattr","fixed_in":["2.6.0-1.el8_10"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"libattr-devel","fixed_in":["2.6.0-1.el8_10"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"attr","fixed_in":["2.6.0-1.el10_2"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"libattr","fixed_in":["2.6.0-1.el10_2"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"libattr-devel","fixed_in":["2.6.0-1.el10_2"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"attr","fixed_in":["2.6.0-1.el9_8"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"libattr","fixed_in":["2.6.0-1.el9_8"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"libattr-devel","fixed_in":["2.6.0-1.el9_8"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"acl","fixed_in":["2.4.0-1"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"attr","fixed_in":["2.6.0-1"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.5","package":"attr","fixed_in":["2.4.48-3.el8.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.5","package":"libattr","fixed_in":["2.4.48-3.el8.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.5","package":"libattr-devel","fixed_in":["2.4.48-3.el8.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.4","package":"attr","fixed_in":["2.4.48-3.el8.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.4","package":"libattr","fixed_in":["2.4.48-3.el8.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.4","package":"libattr-devel","fixed_in":["2.4.48-3.el8.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"attr","fixed_in":["2.6.0-1.el9_2.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"libattr","fixed_in":["2.6.0-1.el9_2.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"libattr-devel","fixed_in":["2.6.0-1.el9_2.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"attr","fixed_in":["2.6.0-1.el9_6.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"libattr","fixed_in":["2.6.0-1.el9_6.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"libattr-devel","fixed_in":["2.6.0-1.el9_6.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"attr","fixed_in":["1:2.6.0-1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"attr","fixed_in":["2.5.1-7.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP3","package":"attr","fixed_in":["2.5.1-7.oe2403sp3"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"attr","fixed_in":["2.4.48-16.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"attr","fixed_in":["2.5.1-6.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP4","package":"attr","fixed_in":["2.5.1-7.oe2403sp4"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"attr","fixed_in":["0:2.6.0-1.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"libattr","fixed_in":["0:2.6.0-1.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"libattr-devel","fixed_in":["0:2.6.0-1.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"attr","fixed_in":["0:2.6.0-1.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"attr-debuginfo","fixed_in":["0:2.6.0-1.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"attr-debugsource","fixed_in":["0:2.6.0-1.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libattr","fixed_in":["0:2.6.0-1.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libattr-debuginfo","fixed_in":["0:2.6.0-1.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libattr-devel","fixed_in":["0:2.6.0-1.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"attr-debuginfo","fixed_in":["0:2.6.0-1.el10_2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"attr-debugsource","fixed_in":["0:2.6.0-1.el10_2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"libattr-debuginfo","fixed_in":["0:2.6.0-1.el10_2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"libattr-devel","fixed_in":["0:2.6.0-1.el10_2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"attr","fixed_in":["0:2.6.0-1.el10_2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"libattr","fixed_in":["0:2.6.0-1.el10_2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"attr-debuginfo","fixed_in":["0:2.6.0-1.el9_8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"attr-debugsource","fixed_in":["0:2.6.0-1.el9_8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libattr-debuginfo","fixed_in":["0:2.6.0-1.el9_8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libattr-devel","fixed_in":["0:2.6.0-1.el9_8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"attr","fixed_in":["0:2.6.0-1.el9_8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"attr-debuginfo","fixed_in":["0:2.6.0-1.el9_8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"attr-debugsource","fixed_in":["0:2.6.0-1.el9_8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"libattr","fixed_in":["0:2.6.0-1.el9_8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"libattr-debuginfo","fixed_in":["0:2.6.0-1.el9_8"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"attr","fixed_in":["0:2.6.0-1.el8_10"],"sources":["osv"]},{"ecosystem":"Rocky Linux:10","package":"attr","fixed_in":["0:2.6.0-1.el10_2"],"sources":["osv"]},{"ecosystem":"Rocky Linux:9","package":"attr","fixed_in":["0:2.6.0-1.el9_8"],"sources":["osv"]},{"ecosystem":"Root:Debian:11","package":"attr","fixed_in":["1:2.4.48-6.aikido.2","1:2.4.48-6.root.io.1"],"sources":["osv"]},{"ecosystem":"Root:Debian:11","package":"rootio-attr","fixed_in":["1:2.4.48-6.aikido.2","1:2.4.48-6.root.io.1"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"attr","fixed_in":["1:2.5.1-4.aikido.2","1:2.5.1-4.root.io.1"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"rootio-attr","fixed_in":["1:2.5.1-4.aikido.2","1:2.5.1-4.root.io.1"],"sources":["osv"]},{"ecosystem":"Root:Debian:13","package":"attr","fixed_in":["1:2.5.2-3.aikido.2","1:2.5.2-3.root.io.1"],"sources":["osv"]},{"ecosystem":"Root:Debian:13","package":"rootio-attr","fixed_in":["1:2.5.2-3.aikido.2","1:2.5.2-3.root.io.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"attr","fixed_in":["1:2.4.47-1ubuntu1+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"attr","fixed_in":["1:2.4.47-2ubuntu0.16.04.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"attr","fixed_in":["1:2.4.47-2ubuntu0.18.04.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"attr","fixed_in":["1:2.4.48-5ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"attr","fixed_in":["1:2.5.1-1ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"attr","fixed_in":["1:2.5.2-1ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"attr","fixed_in":["1:2.5.2-4ubuntu0.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:8","package":"attr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.0-1.el8_10"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"libattr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.0-1.el8_10"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"libattr-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.0-1.el8_10"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"attr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.0-1.el10_2"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"libattr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.0-1.el10_2"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"libattr-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.0-1.el10_2"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"attr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.0-1.el9_8"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"libattr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.0-1.el9_8"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"libattr-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.0-1.el9_8"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"acl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"attr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.0-1"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"attr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.48-3.el8.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"libattr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.48-3.el8.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"libattr-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.48-3.el8.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"attr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.48-3.el8.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"libattr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.48-3.el8.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"libattr-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.48-3.el8.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"attr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.0-1.el9_2.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"libattr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.0-1.el9_2.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"libattr-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.0-1.el9_2.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"attr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.0-1.el9_6.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"libattr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.0-1.el9_6.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"libattr-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.0-1.el9_6.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"attr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:2.5.1-4","1:2.5.1-5","1:2.5.2-1","1:2.5.2-2","1:2.5.2-3","1:2.5.2-4","1:2.6.0-1"]},{"source":"osv","ecosystem":"Debian:13","package":"attr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:2.5.2-3","1:2.5.2-4","1:2.6.0-1"]},{"source":"osv","ecosystem":"Debian:14","package":"attr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.6.0-1"}]}],"versions":["1:2.5.2-3","1:2.5.2-4"]},{"source":"osv","ecosystem":"Mageia:10","package":"acl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-3.mga10"}]}],"bundled":3},{"source":"osv","ecosystem":"Mageia:10","package":"attr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.0-1.mga10"}]}],"bundled":3},{"source":"osv","ecosystem":"Mageia:9","package":"acl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-1.mga9"}]}],"bundled":3},{"source":"osv","ecosystem":"Mageia:9","package":"attr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.0-1.mga9"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"attr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.1-7.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"attr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.1-7.oe2403sp3"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"attr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.48-16.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"attr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.1-6.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP4","package":"attr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.1-7.oe2403sp4"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"attr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.0-1.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libattr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.0-1.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libattr-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.0-1.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"attr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.0-1.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"attr-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.0-1.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"attr-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.0-1.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libattr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.0-1.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libattr-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.0-1.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libattr-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.0-1.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"attr-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.0-1.el10_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"attr-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.0-1.el10_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"libattr-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.0-1.el10_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"libattr-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.0-1.el10_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"attr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.0-1.el10_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"libattr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.0-1.el10_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"attr-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.0-1.el9_8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"attr-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.0-1.el9_8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libattr-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.0-1.el9_8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libattr-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.0-1.el9_8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"attr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.0-1.el9_8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"attr-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.0-1.el9_8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"attr-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.0-1.el9_8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"libattr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.0-1.el9_8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"libattr-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.0-1.el9_8"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"attr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.0-1.el8_10"}]}]},{"source":"osv","ecosystem":"Rocky Linux:10","package":"attr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.0-1.el10_2"}]}]},{"source":"osv","ecosystem":"Rocky Linux:9","package":"attr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.0-1.el9_8"}]}]},{"source":"osv","ecosystem":"Root:Debian:11","package":"attr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.48-6.aikido.2"},{"fixed":"1:2.4.48-6.root.io.1"}]}]},{"source":"osv","ecosystem":"Root:Debian:11","package":"rootio-attr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.48-6.aikido.2"},{"fixed":"1:2.4.48-6.root.io.1"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"attr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.5.1-4.aikido.2"},{"fixed":"1:2.5.1-4.root.io.1"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"rootio-attr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.5.1-4.aikido.2"},{"fixed":"1:2.5.1-4.root.io.1"}]}]},{"source":"osv","ecosystem":"Root:Debian:13","package":"attr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.5.2-3.aikido.2"},{"fixed":"1:2.5.2-3.root.io.1"}]}]},{"source":"osv","ecosystem":"Root:Debian:13","package":"rootio-attr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.5.2-3.aikido.2"},{"fixed":"1:2.5.2-3.root.io.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"acl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-160000.1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"attr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.0-160000.1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"acl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-160000.1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"attr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.0-160000.1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"acl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-160000.1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"attr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.0-160000.1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"acl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-160000.1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"attr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.0-160000.1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"acl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-160000.1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"attr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.0-160000.1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"acl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-150000.4.6.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"attr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.0-150000.4.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"acl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-150000.4.6.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"attr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.0-150000.4.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"acl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-150000.4.6.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"attr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.0-150000.4.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"acl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-150000.4.6.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"attr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.0-150000.4.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"acl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-150000.4.6.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"attr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.0-150000.4.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"acl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-150000.4.6.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"attr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.0-150000.4.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"acl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-150000.4.6.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"attr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.0-150000.4.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"acl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-150000.4.6.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"attr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.0-150000.4.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"acl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-150000.4.6.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"attr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.0-150000.4.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"acl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-150000.4.6.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"attr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.0-150000.4.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"acl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-150000.4.6.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"attr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.0-150000.4.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"acl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-150000.4.6.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"attr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.0-150000.4.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"acl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-150000.4.6.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"attr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.0-150000.4.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"acl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-150000.4.6.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"attr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.0-150000.4.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"attr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.47-1ubuntu1+esm1"}]}],"versions":["1:2.4.47-1","1:2.4.47-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"attr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.47-2ubuntu0.16.04.1~esm1"}]}],"versions":["1:2.4.47-2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"attr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.47-2ubuntu0.18.04.1~esm1"}]}],"versions":["1:2.4.47-2build1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"attr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.48-5ubuntu0.1~esm1"}]}],"versions":["1:2.4.48-4","1:2.4.48-5"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"attr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.5.1-1ubuntu0.1"}]}],"versions":["1:2.4.48-6build2","1:2.5.1-1","1:2.5.1-1build1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"attr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.5.2-1ubuntu0.1"}]}],"versions":["1:2.5.1-4","1:2.5.1-5","1:2.5.2-1","1:2.5.2-1build1","1:2.5.2-1build1.1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"attr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:2.5.2-3","1:2.5.2-3build1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"attr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.5.2-4ubuntu0.1"}]}],"versions":["1:2.5.2-3build1","1:2.5.2-3build2","1:2.5.2-4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"attr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.47-1ubuntu1+esm1"}]}],"versions":["1:2.4.47-1","1:2.4.47-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"attr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.47-2ubuntu0.16.04.1~esm1"}]}],"versions":["1:2.4.47-2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"attr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.47-2ubuntu0.18.04.1~esm1"}]}],"versions":["1:2.4.47-2build1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"attr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.48-5ubuntu0.1~esm1"}]}],"versions":["1:2.4.48-4","1:2.4.48-5"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"attr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.5.1-1ubuntu0.1"}]}],"versions":["1:2.4.48-6build2","1:2.5.1-1","1:2.5.1-1build1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"attr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.5.2-1ubuntu0.1"}]}],"versions":["1:2.5.1-4","1:2.5.1-5","1:2.5.2-1","1:2.5.2-1build1","1:2.5.2-1build1.1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"attr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.5.2-4ubuntu0.1"}]}],"versions":["1:2.5.2-3build1","1:2.5.2-3build2","1:2.5.2-4"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"acl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"acl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-160000.1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"attr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.0-160000.1.1"}]}],"bundled":3}],"products":[{"vendor":"attr project","product":"attr"},{"vendor":"red hat","product":"cert manager support for red hat openshift release 1.19"},{"vendor":"red hat","product":"red hat discovery 2"},{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 6"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"red hat","product":"red hat hardened images"},{"vendor":"red hat","product":"red hat openshift container platform 4"},{"vendor":"red hat","product":"red hat update infrastructure 5"}],"references":[{"url":"https://cgit.git.savannah.nongnu.org/cgit/attr.git/commit/?id=c440855d6b33446edf4b5eb1a2d892281f15a99b","tags":["patch","fix"]},{"url":"https://cgit.git.savannah.nongnu.org/cgit/attr.git/commit/?id=49f79e947270f06940b9100fa638f85dddc4aa7f","tags":["issue-tracking","report"]},{"url":"https://www.vulncheck.com/advisories/attr-symlink-traversal-privilege-escalation-via-getfattr-setfattr","tags":["third-party-advisory","advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-54371","tags":["vdb-entry","x_refsource_REDHAT","report","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2490283","tags":["issue-tracking","x_refsource_REDHAT","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54371.json","tags":["x_sadp-csaf-vex","web","report"]},{"url":"https://access.redhat.com/errata/RHSA-2026:59380","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:60226","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:56133","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:63135","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:63138","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:61783","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:34889","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:66018","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54371","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-hh95-r7mj-c9j5"},{"url":"https://bugzilla.redhat.com/2490283","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2026-56133.html","tags":["advisory"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-59380.html","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-60226.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos8.5els/CLSA-2026-1785346928.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos8.4els/CLSA-2026-1785347213.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1787146803.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1787148007.html","tags":["advisory"]},{"url":"https://savannah.nongnu.org/projects/attr/","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54371.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-54371","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0321.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35779","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2026/06/29/1","tags":["web","report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3TDUECPBS6YQPFZZ6RNXV3T5EFLLHQZS/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CGDSXLCG4AXTWFBAKM6XYUUYO6LZ7YXY/","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/NOOHLEV27XADU2EMOLPK2E6IY2TZKFKQ/","tags":["web"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2913","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2914","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2915","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2916","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3080","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_34889.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-54371","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_56133.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_59380.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_60226.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:56133","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:59380","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:60226","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623670-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1268867","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54369","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54370","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54371","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623705-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623726-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264176-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-54371","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8691-1","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-54371","title":"attr \u003c 2.6.0 Symlink Traversal Privilege Escalation via getfattr/setfattr","description":"attr before version 2.6.0 contains a symlink traversal vulnerability in the getfattr and setfattr utilities that allows local attackers to escalate privileges by replacing a pathname component with a symbolic link during directory hierarchy traversal. Attackers who control a pathname component can redirect getfattr and setfattr operations to arbitrary files by substituting a symlink, leading to local privilege escalation when getfattr or setfattr is invoked by a privileged process over an attacker-controlled path.","status":"published","published":"2026-06-29T12:39:23.594Z","modified":"2026-09-11T12:08:58.704Z","cvss":[{"version":"4.0","score":8.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high","assessor":"cna"},{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"cna"},{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-59","CWE-59"],"updated_at":"2026-11-02T13:37:58.613221Z"}],"euvd":[{"id":"EUVD-2026-40087","description":"attr before version 2.6.0 contains a symlink traversal vulnerability in the getfattr and setfattr utilities that allows local attackers to escalate privileges by replacing a pathname component with a symbolic link during directory hierarchy traversal. Attackers who control a pathname component can redirect getfattr and setfattr operations to arbitrary files by substituting a symlink, leading to local privilege escalation when getfattr or setfattr is invoked by a privileged process over an attacker-controlled path.","status":"published","published":"2026-06-29T12:39:23Z","modified":"2026-09-11T12:08:58Z","cvss":[{"version":"4.0","score":8.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T17:28:22.994693Z"}],"ghsa":[{"id":"GHSA-hh95-r7mj-c9j5","title":"attr before version 2.6.0 contains a symlink traversal vulnerability in the getfattr and setfattr...","description":"attr before version 2.6.0 contains a symlink traversal vulnerability in the getfattr and setfattr utilities that allows local attackers to escalate privileges by replacing a pathname component with a symbolic link during directory hierarchy traversal. Attackers who control a pathname component can redirect getfattr and setfattr operations to arbitrary files by substituting a symlink, leading to local privilege escalation when getfattr or setfattr is invoked by a privileged process over an attacker-controlled path.","status":"published","published":"2026-06-29T15:32:06Z","modified":"2026-09-11T15:32:25Z","cvss":[{"version":"4.0","score":8.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"},{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-59"],"updated_at":"2026-11-02T15:11:44.427999Z"}],"nvd":[{"id":"CVE-2026-54371","description":"attr before version 2.6.0 contains a symlink traversal vulnerability in the getfattr and setfattr utilities that allows local attackers to escalate privileges by replacing a pathname component with a symbolic link during directory hierarchy traversal. Attackers who control a pathname component can redirect getfattr and setfattr operations to arbitrary files by substituting a symlink, leading to local privilege escalation when getfattr or setfattr is invoked by a privileged process over an attacker-controlled path.","status":"published","published":"2026-06-29T14:16:57.823Z","modified":"2026-10-25T21:10:00.77Z","cvss":[{"version":"4.0","score":8.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"secondary"},{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-59"],"updated_at":"2026-11-02T14:12:26.508751Z"}],"osv":[{"id":"CVE-2026-54371","title":"attr \u003c 2.6.0 Symlink Traversal Privilege Escalation via getfattr/setfattr","description":"attr before version 2.6.0 contains a symlink traversal vulnerability in the getfattr and setfattr utilities that allows local attackers to escalate privileges by replacing a pathname component with a symbolic link during directory hierarchy traversal. Attackers who control a pathname component can redirect getfattr and setfattr operations to arbitrary files by substituting a symlink, leading to local privilege escalation when getfattr or setfattr is invoked by a privileged process over an attacker-controlled path.","status":"published","published":"2026-06-29T12:39:23.594Z","modified":"2026-10-31T10:30:16.983988487Z","cvss":[{"version":"4.0","score":8.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-59"],"updated_at":"2026-11-02T15:45:10.818486Z"},{"id":"DEBIAN-CVE-2026-54371","description":"attr before version 2.6.0 contains a symlink traversal vulnerability in the getfattr and setfattr utilities that allows local attackers to escalate privileges by replacing a pathname component with a symbolic link during directory hierarchy traversal. Attackers who control a pathname component can redirect getfattr and setfattr operations to arbitrary files by substituting a symlink, leading to local privilege escalation when getfattr or setfattr is invoked by a privileged process over an attacker-controlled path.","status":"published","published":"2026-06-29T14:16:57.823Z","modified":"2026-10-26T11:47:34.709388452Z","cvss":[{"version":"4.0","score":8.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"updated_at":"2026-11-02T15:45:57.236551Z"},{"id":"OESA-2026-2913","title":"attr security update","description":"A set of tools for manipulating extended attributes on file system objects, in particular getfattr(1) and setfattr(1). An attr(1) command is also provided, which is largely compatible with the SGI IRIX tool of the same name.\r\n\r\nSecurity Fix(es):\n\nattr before version 2.6.0 contains a symlink traversal vulnerability in the getfattr and setfattr utilities that allows local attackers to escalate privileges by replacing a pathname component with a symbolic link during directory hierarchy traversal. Attackers who control a pathname component can redirect getfattr and setfattr operations to arbitrary files by substituting a symlink, leading to local privilege escalation when getfattr or setfattr is invoked by a privileged process over an attacker-controlled path.(CVE-2026-54371)","status":"published","published":"2026-07-09T11:11:49Z","modified":"2026-08-18T01:21:15.601207584Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"OESA-2026-2914","title":"attr security update","description":"A set of tools for manipulating extended attributes on file system objects, in particular getfattr(1) and setfattr(1). An attr(1) command is also provided, which is largely compatible with the SGI IRIX tool of the same name.\r\n\r\nSecurity Fix(es):\n\nattr before version 2.6.0 contains a symlink traversal vulnerability in the getfattr and setfattr utilities that allows local attackers to escalate privileges by replacing a pathname component with a symbolic link during directory hierarchy traversal. Attackers who control a pathname component can redirect getfattr and setfattr operations to arbitrary files by substituting a symlink, leading to local privilege escalation when getfattr or setfattr is invoked by a privileged process over an attacker-controlled path.(CVE-2026-54371)","status":"published","published":"2026-07-09T11:11:49Z","modified":"2026-08-18T01:21:15.153909644Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"OESA-2026-2915","title":"attr security update","description":"A set of tools for manipulating extended attributes on file system objects, in particular getfattr(1) and setfattr(1). An attr(1) command is also provided, which is largely compatible with the SGI IRIX tool of the same name.\r\n\r\nSecurity Fix(es):\n\nattr before version 2.6.0 contains a symlink traversal vulnerability in the getfattr and setfattr utilities that allows local attackers to escalate privileges by replacing a pathname component with a symbolic link during directory hierarchy traversal. Attackers who control a pathname component can redirect getfattr and setfattr operations to arbitrary files by substituting a symlink, leading to local privilege escalation when getfattr or setfattr is invoked by a privileged process over an attacker-controlled path.(CVE-2026-54371)","status":"published","published":"2026-07-09T11:11:49Z","modified":"2026-08-18T01:21:15.75129875Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"OESA-2026-2916","title":"attr security update","description":"A set of tools for manipulating extended attributes on file system objects, in particular getfattr(1) and setfattr(1). An attr(1) command is also provided, which is largely compatible with the SGI IRIX tool of the same name.\r\n\r\nSecurity Fix(es):\n\nattr before version 2.6.0 contains a symlink traversal vulnerability in the getfattr and setfattr utilities that allows local attackers to escalate privileges by replacing a pathname component with a symbolic link during directory hierarchy traversal. Attackers who control a pathname component can redirect getfattr and setfattr operations to arbitrary files by substituting a symlink, leading to local privilege escalation when getfattr or setfattr is invoked by a privileged process over an attacker-controlled path.(CVE-2026-54371)","status":"published","published":"2026-07-09T11:11:49Z","modified":"2026-08-18T01:21:15.915513121Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"OESA-2026-3080","title":"attr security update","description":"A set of tools for manipulating extended attributes on file system objects, in particular getfattr(1) and setfattr(1). An attr(1) command is also provided, which is largely compatible with the SGI IRIX tool of the same name.\r\n\r\nSecurity Fix(es):\n\nattr before version 2.6.0 contains a symlink traversal vulnerability in the getfattr and setfattr utilities that allows local attackers to escalate privileges by replacing a pathname component with a symbolic link during directory hierarchy traversal. Attackers who control a pathname component can redirect getfattr and setfattr operations to arbitrary files by substituting a symlink, leading to local privilege escalation when getfattr or setfattr is invoked by a privileged process over an attacker-controlled path.(CVE-2026-54371)","status":"published","published":"2026-07-19T11:11:58Z","modified":"2026-08-18T01:21:20.311152998Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"RHSA-2026:34889","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","status":"published","published":"2026-07-03T10:13:56Z","modified":"2026-10-15T10:17:28Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:19.963895Z"},{"id":"RHSA-2026:56133","title":"Red Hat Security Advisory: attr security update","status":"published","published":"2026-08-19T10:22:55Z","modified":"2026-10-15T10:21:35Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:21.457353Z"},{"id":"RHSA-2026:59380","title":"Red Hat Security Advisory: attr security update","status":"published","published":"2026-08-26T10:18:10Z","modified":"2026-10-15T10:22:28Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:21.91255Z"},{"id":"RHSA-2026:60226","title":"Red Hat Security Advisory: attr security update","status":"published","published":"2026-08-27T10:16:05Z","modified":"2026-10-15T10:22:45Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:21.91255Z"},{"id":"RLSA-2026:56133","title":"Moderate: attr security update","description":"The attr packages provide extended attributes, which can be used to store system objects like capabilities of executables and access control lists, as well as user objects.\n\nSecurity Fix(es):\n\n* attr: Symlink Traversal Privilege Escalation via getfattr and setfattr (CVE-2026-54371)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-08-19T06:01:07.331619Z","modified":"2026-08-19T06:30:05.580608769Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:26.111232Z"},{"id":"RLSA-2026:59380","title":"Moderate: attr security update","description":"The attr packages provide extended attributes, which can be used to store system objects like capabilities of executables and access control lists, as well as user objects.\n\nSecurity Fix(es):\n\n* attr: Symlink Traversal Privilege Escalation via getfattr and setfattr (CVE-2026-54371)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-08-26T12:08:23.18754Z","modified":"2026-08-26T12:30:04.32673549Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:26.111232Z"},{"id":"RLSA-2026:60226","title":"Moderate: attr security update","description":"The attr packages provide extended attributes, which can be used to store system objects like capabilities of executables and access control lists, as well as user objects.\n\nSecurity Fix(es):\n\n* attr: Symlink Traversal Privilege Escalation via getfattr and setfattr (CVE-2026-54371)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-08-27T12:05:26.997131Z","modified":"2026-08-27T12:30:25.616242492Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:26.111232Z"},{"id":"UBUNTU-CVE-2026-54371","description":"attr before version 2.6.0 contains a symlink traversal vulnerability in the getfattr and setfattr utilities that allows local attackers to escalate privileges by replacing a pathname component with a symbolic link during directory hierarchy traversal. Attackers who control a pathname component can redirect getfattr and setfattr operations to arbitrary files by substituting a symlink, leading to local privilege escalation when getfattr or setfattr is invoked by a privileged process over an attacker-controlled path.","status":"published","published":"2026-06-29T14:16:00Z","modified":"2026-08-31T22:15:26.918166615Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"},{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"medium"},{"version":"4.0","score":8.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T16:56:41.382716Z"},{"id":"ALSA-2026:56133","title":"Moderate: attr security update","description":"The attr packages provide extended attributes, which can be used to store system objects like capabilities of executables and access control lists, as well as user objects.  \n\nSecurity Fix(es):  \n\n  * attr: Symlink Traversal Privilege Escalation via getfattr and setfattr (CVE-2026-54371)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-08-18T00:00:00Z","modified":"2026-10-29T11:02:26.399053067Z","updated_at":"2026-11-02T15:27:54.753319Z"},{"id":"ALSA-2026:59380","title":"Moderate: attr security update","description":"The attr packages provide extended attributes, which can be used to store system objects like capabilities of executables and access control lists, as well as user objects.  \n\nSecurity Fix(es):  \n\n  * attr: Symlink Traversal Privilege Escalation via getfattr and setfattr (CVE-2026-54371)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-08-25T00:00:00Z","modified":"2026-10-29T11:30:47.285537229Z","updated_at":"2026-11-02T15:27:54.753319Z"},{"id":"ALSA-2026:60226","title":"Moderate: attr security update","description":"The attr packages provide extended attributes, which can be used to store system objects like capabilities of executables and access control lists, as well as user objects.  \n\nSecurity Fix(es):  \n\n  * attr: Symlink Traversal Privilege Escalation via getfattr and setfattr (CVE-2026-54371)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-08-26T00:00:00Z","modified":"2026-10-29T11:32:08.04401217Z","updated_at":"2026-11-02T15:27:54.753319Z"},{"id":"AZL-91400","title":"CVE-2026-54371 affecting package acl for versions less than 2.4.0-1","description":"attr before version 2.6.0 contains a symlink traversal vulnerability in the getfattr and setfattr utilities that allows local attackers to escalate privileges by replacing a pathname component with a symbolic link during directory hierarchy traversal. Attackers who control a pathname component can redirect getfattr and setfattr operations to arbitrary files by substituting a symlink, leading to local privilege escalation when getfattr or setfattr is invoked by a privileged process over an attacker-controlled path.","status":"published","published":"2026-06-29T14:16:57Z","modified":"2026-08-28T17:56:57.631809Z","updated_at":"2026-11-02T15:28:11.397546Z"},{"id":"AZL-91424","title":"CVE-2026-54371 affecting package attr for versions less than 2.6.0-1","description":"attr before version 2.6.0 contains a symlink traversal vulnerability in the getfattr and setfattr utilities that allows local attackers to escalate privileges by replacing a pathname component with a symbolic link during directory hierarchy traversal. Attackers who control a pathname component can redirect getfattr and setfattr operations to arbitrary files by substituting a symlink, leading to local privilege escalation when getfattr or setfattr is invoked by a privileged process over an attacker-controlled path.","status":"published","published":"2026-06-29T14:16:57Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:25.633663Z"},{"id":"CLSA-2026-1785346928","title":"attr: Fix of CVE-2026-54371","description":"- CVE-2026-54371: symlink traversal in the recursive directory walk of\n  getfattr, letting a local attacker who controls a path component swap it\n  for a symlink and redirect extended-attribute reads to arbitrary files","status":"published","published":"2026-07-29T17:42:17Z","modified":"2026-10-26T09:31:51.222112081Z","updated_at":"2026-11-02T15:43:46.482572Z"},{"id":"CLSA-2026-1785347213","title":"attr: Fix of CVE-2026-54371","description":"- CVE-2026-54371: symlink traversal in the recursive directory walk of\n  getfattr, letting a local attacker who controls a path component swap it\n  for a symlink and redirect extended-attribute reads to arbitrary files","status":"published","published":"2026-07-29T17:47:02Z","modified":"2026-10-26T09:31:50.621500378Z","updated_at":"2026-11-02T15:43:46.482572Z"},{"id":"CLSA-2026-1787146803","title":"attr: Fix of CVE-2026-54371","description":"- Rebase to attr-2.6.0; CVE-2026-54371 fixed upstream\n- setfattr: new -P/--physical option; --restore is symlink-safe only with -P\n- setfattr --restore now warns on stderr when -P/-h are absent\n- getfattr -Rh now recurses through a symlink argument (previously no output)","status":"published","published":"2026-08-19T13:40:14Z","modified":"2026-10-26T09:30:32.327181754Z","updated_at":"2026-11-02T15:43:47.20725Z"},{"id":"CLSA-2026-1787148007","title":"attr: Fix of CVE-2026-54371","description":"- Rebase to attr-2.6.0; CVE-2026-54371 fixed upstream\n- setfattr: new -P/--physical option; --restore is symlink-safe only with -P\n- setfattr --restore now warns on stderr when -P/-h are absent\n- getfattr -Rh now recurses through a symlink argument (previously no output)","status":"published","published":"2026-08-19T14:00:17Z","modified":"2026-10-26T09:31:04.137648094Z","updated_at":"2026-11-02T15:43:47.20725Z"},{"id":"MGASA-2026-0321","title":"Updated acl attr packages fix security vulnerabilities","description":"The updated acl and attr packages fix security issues.\n","status":"published","published":"2026-08-04T17:15:44Z","modified":"2026-08-04T17:30:04.430702659Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:11312-1","title":"acl-2.4.0-1.1 on GA media","description":"These are all security issues fixed in the acl-2.4.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-07-20T00:00:00Z","modified":"2026-07-21T09:45:08.183172209Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"openSUSE-SU-2026:21832-1","title":"Security update for acl, attr","description":"This update for acl, attr fixes the following issue:\n\n- CVE-2026-54369,CVE-2026-54370,CVE-2026-54371: Symlink Traversal Privilege Escalation via getfattr/setfattr,\n  getfacl/setfacl/chacl, libacl (bsc#1268867).\n\nChanges for acl:\n\n- Update to 2.4.0 (jsc#PED-16501):\n Major Issues Fixed:\n - The libacl library functions acl_get_file(), acl_set_file(),\n acl_extended_file(), and acl_delete_def_file() take a pathname argument\n and follow symbolic links. When a privileged user calls one of those\n functions, an attacker that controls a pathname component can replace a\n file or directory with a symbolic link and redirect the operation to a\n different file. This can lead to local privilege escalation.\n (CVE-2026-54369, bsc#1268867)\n The library functions cannot be fixed without breaking compatibility; the\n described behaviour is by design.\n Instead, version 2.4.0 of the acl package introduces the additional\n functions acl_get_file_at(), acl_set_file_at(), acl_extended_file_at(), and\n acl_delete_def_file_at(). These functions each take a dirfd file\n descriptor argument and an at_flags argument and accept the\n AT_SYMLINK_NOFOLLOW and AT_EMPTY_PATH flags. Use these functions to\n control when to follow symbolic links. (CVE-2026-54370, bsc#1268867)\n In addition, the libacl functions acl_get_fd(), acl_set_fd(), and\n acl_extended_fd() functions always operate on the access ACL; the library\n previously did not offer a way to operate on the default ACL of a directory\n file descriptor. The new functions remove that restriction.\n It will be up to each individual program to start using these new library\n functions where appropriate.\n - When walking directory trees, the getfacl, setfacl, chacl, and getfattr\n utilities constructed the full pathname of each file in the tree and use that\n pathname to access the file. When a privileged user used those utilities,\n an attacker that controlled a pathname component could replace a directory with\n a symbolic link and redirect the operation to a different file, leading to\n a local privilege escalation. (CVE-2026-54371, bsc#1268867)\n This is fixed by using directory file descriptors and operating relative to\n those directory file descriptors.\n - When resolving the final pathname component, the getfacl, setfacl, chacl,\n getfattr, and setfattr utilities in some cases used functions that resolve\n symbolic links. This includes the above mentioned libacl functions, but\n also stat(), chmod(), and chown().\n This is fixed by using symlink-safe functions throughout the code.\n - When restoring a backup, the setfacl and setfattr utilities read the full\n pathnames of files from the backup. When those pathnames were resolved,\n pathname components that are symbolic links were traversed. An attacker\n that controlled a pathname component could replace it with a symbolic link,\n causing a privileged user to operate on a file other than the one intended.\n This could lead to the same kind of local privilege escalation as discussed\n before.\n This is fixed by using openat2(RESOLVE_NO_SYMLINKS) to resolve the\n directory components of a pathname, but see Compatibility Notes below for\n the details.\nMinor Issues Fixed:\n - When a symbolic link was specified on the command line but symbolic link\n traversal was disabled using option -P (--physical), the getfacl and\n setfacl utilities previously silently ignored the symlink. Now, an ELOOP\n (\"Too many levels of symbolic links\") error will result instead.\n - acl_delete_entry() now verifies that the specified entry belongs to the\n specified acl.\n - Numeric uids and gids that cannot be represented in types uid_t and gid_t\n are checked more carefully and invalid numbers are rejected.\n - Functions acl_get_file(), acl_get_file_at(), and acl_get_fd() will retry\n several times when the size of an ACL grows unexpectedly; previously, they\n only grew the allocated buffer once before giving up.\n - When passed a directory file descriptor, function perm_copy_fd() didn't\n copy the default ACL from one directory to the other. It now does.\n - setfacl --restore accidentally ignored leading whitespace in filenames. It\n no longer does.\n - setfacl --restore accidentally called chmod() when in --test mode. It no\n longer does.\n - When the setfattr --restore option was used multiple times, a buffer was\n accessed after being freed. This no longer happens.\n - When the setfattr -h (--no-dereference) option was given after --restore,\n it was ignored. Now, the options can be passed in any order.\n - The -h (--no-dereference) option of getfattr prevented getfattr from\n recursing into \"symbolic link directories\". This is wrong. When dirlink\n is a symbolic link that refers to a directory, \"getfattr -Rh dirlink\" will now\n visit that directory. The -P (--physical) option can be used to prevent\n that.\n - Similarly, when a symbolic link referring to a directory was specified on\n the getfacl or setfacl command line, the -R option did not cause that\n directory to be visited. This has been fixed so that those directories\n will now be visited. The -P (--physical) option can be used to prevent\n\nChanges for attr:\n\n- Update to 2.6.0 (jsc#PED-16501):\nMajor Issues Fixed:\n - The libacl library functions acl_get_file(), acl_set_file(),\n acl_extended_file(), and acl_delete_def_file() take a pathname argument\n and follow symbolic links. When a privileged user calls one of those\n functions, an attacker that controls a pathname component can replace a\n file or directory with a symbolic link and redirect the operation to a\n different file. This can lead to local privilege escalation.\n (CVE-2026-54369, bsc#1268867)\n The library functions cannot be fixed without breaking compatibility; the\n described behaviour is by design.\n Instead, version 2.4.0 of the acl package introduces the additional\n functions acl_get_file_at(), acl_set_file_at(), acl_extended_file_at(), and\n acl_delete_def_file_at(). These functions each take a dirfd file\n descriptor argument and an at_flags argument and accept the\n AT_SYMLINK_NOFOLLOW and AT_EMPTY_PATH flags. Use these functions to\n control when to follow symbolic links. (CVE-2026-54370, bsc#1268867)\n In addition, the libacl functions acl_get_fd(), acl_set_fd(), and\n acl_extended_fd() functions always operate on the access ACL; the library\n previously did not offer a way to operate on the default ACL of a directory\n file descriptor. The new functions remove that restriction.\n It will be up to each individual program to start using these new library\n functions where appropriate.\n - When walking directory trees, the getfacl, setfacl, chacl, and getfattr\n utilities constructed the full pathname of each file in the tree\nand use that\n pathname to access the file. When a privileged user used those utilities,\n an attacker that controlled a pathname component could replace a\ndirectory with\n a symbolic link and redirect the operation to a different file, leading to\n a local privilege escalation. (CVE-2026-54371, bsc#1268867)\n This is fixed by using directory file descriptors and operating relative to\n those directory file descriptors.\n - When resolving the final pathname component, the getfacl, setfacl, chacl,\n getfattr, and setfattr utilities in some cases used functions that resolve\n symbolic links. This includes the above mentioned libacl functions, but\n also stat(), chmod(), and chown().\n This is fixed by using symlink-safe functions throughout the code.\n - When restoring a backup, the setfacl and setfattr utilities read the full\n pathnames of files from the backup. When those pathnames were resolved,\n pathname components that are symbolic links were traversed. An attacker\n that controlled a pathname component could replace it with a symbolic link,\n causing a privileged user to operate on a file other than the one intended.\n This could lead to the same kind of local privilege escalation as discussed\n before.\n This is fixed by using openat2(RESOLVE_NO_SYMLINKS) to resolve the\n directory components of a pathname, but see Compatibility Notes below for\n the details.\nMinor Issues Fixed:\n - When a symbolic link was specified on the command line but symbolic link\n traversal was disabled using option -P (--physical), the getfacl and\n setfacl utilities previously silently ignored the symlink. Now, an ELOOP\n (\"Too many levels of symbolic links\") error will result instead.\n - acl_delete_entry() now verifies that the specified entry belongs to the\n specified acl.\n - Numeric uids and gids that cannot be represented in types uid_t and gid_t\n are checked more carefully and invalid numbers are rejected.\n - Functions acl_get_file(), acl_get_file_at(), and acl_get_fd() will retry\n several times when the size of an ACL grows unexpectedly; previously, they\n only grew the allocated buffer once before giving up.\n - When passed a directory file descriptor, function perm_copy_fd() didn't\n copy the default ACL from one directory to the other. It now does.\n - setfacl --restore accidentally ignored leading whitespace in filenames. It\n no longer does.\n - setfacl --restore accidentally called chmod() when in --test mode. It no\n longer does.\n - When the setfattr --restore option was used multiple times, a buffer was\n accessed after being freed. This no longer happens.\n - When the setfattr -h (--no-dereference) option was given after --restore,\n it was ignored. Now, the options can be passed in any order.\n - The -h (--no-dereference) option of getfattr prevented getfattr from\n recursing into \"symbolic link directories\". This is wrong. When dirlink\n is a symbolic link that refers to a directory, \"getfattr -Rh\ndirlink\" will now\n visit that directory. The -P (--physical) option can be used to prevent\n that.\n - Similarly, when a symbolic link referring to a directory was specified on\n the getfacl or setfacl command line, the -R option did not cause that\n directory to be visited. This has been fixed so that those directories\n will now be visited. The -P (--physical) option can be used to prevent\n","status":"published","published":"2026-09-11T11:45:57Z","modified":"2026-09-13T12:15:04.274076715Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"ROOT-OS-DEBIAN-11-CVE-2026-54371","title":"CVE-2026-54371 in attr - Patched by Root","description":"Root has patched CVE-2026-54371 in the attr package for Root:Debian:11. Multiple fixed versions available.","status":"published","published":"2026-08-20T12:01:26Z","modified":"2026-08-20T13:30:06.355992648Z","updated_at":"2026-11-02T15:53:30.44348Z"},{"id":"ROOT-OS-DEBIAN-12-CVE-2026-54371","title":"CVE-2026-54371 in attr - Patched by Root","description":"Root has patched CVE-2026-54371 in the attr package for Root:Debian:12. Multiple fixed versions available.","status":"published","published":"2026-08-25T08:20:40Z","modified":"2026-08-26T01:10:39.553996079Z","updated_at":"2026-11-02T15:53:32.298225Z"},{"id":"ROOT-OS-DEBIAN-13-CVE-2026-54371","title":"CVE-2026-54371 in attr - Patched by Root","description":"Root has patched CVE-2026-54371 in the attr package for Root:Debian:13. Multiple fixed versions available.","status":"published","published":"2026-08-23T14:03:58Z","modified":"2026-08-23T17:00:03.162403957Z","updated_at":"2026-11-02T15:53:33.681527Z"},{"id":"SUSE-SU-2026:23670-1","title":"Security update for acl, attr","description":"This update for acl, attr fixes the following issue:\n\n- CVE-2026-54369,CVE-2026-54370,CVE-2026-54371: Symlink Traversal Privilege Escalation via getfattr/setfattr,\n  getfacl/setfacl/chacl, libacl (bsc#1268867).\n\nChanges for acl:\n\n- Update to 2.4.0 (jsc#PED-16501):\n Major Issues Fixed:\n - The libacl library functions acl_get_file(), acl_set_file(),\n acl_extended_file(), and acl_delete_def_file() take a pathname argument\n and follow symbolic links. When a privileged user calls one of those\n functions, an attacker that controls a pathname component can replace a\n file or directory with a symbolic link and redirect the operation to a\n different file. This can lead to local privilege escalation.\n (CVE-2026-54369, bsc#1268867)\n The library functions cannot be fixed without breaking compatibility; the\n described behaviour is by design.\n Instead, version 2.4.0 of the acl package introduces the additional\n functions acl_get_file_at(), acl_set_file_at(), acl_extended_file_at(), and\n acl_delete_def_file_at(). These functions each take a dirfd file\n descriptor argument and an at_flags argument and accept the\n AT_SYMLINK_NOFOLLOW and AT_EMPTY_PATH flags. Use these functions to\n control when to follow symbolic links. (CVE-2026-54370, bsc#1268867)\n In addition, the libacl functions acl_get_fd(), acl_set_fd(), and\n acl_extended_fd() functions always operate on the access ACL; the library\n previously did not offer a way to operate on the default ACL of a directory\n file descriptor. The new functions remove that restriction.\n It will be up to each individual program to start using these new library\n functions where appropriate.\n - When walking directory trees, the getfacl, setfacl, chacl, and getfattr\n utilities constructed the full pathname of each file in the tree and use that\n pathname to access the file. When a privileged user used those utilities,\n an attacker that controlled a pathname component could replace a directory with\n a symbolic link and redirect the operation to a different file, leading to\n a local privilege escalation. (CVE-2026-54371, bsc#1268867)\n This is fixed by using directory file descriptors and operating relative to\n those directory file descriptors.\n - When resolving the final pathname component, the getfacl, setfacl, chacl,\n getfattr, and setfattr utilities in some cases used functions that resolve\n symbolic links. This includes the above mentioned libacl functions, but\n also stat(), chmod(), and chown().\n This is fixed by using symlink-safe functions throughout the code.\n - When restoring a backup, the setfacl and setfattr utilities read the full\n pathnames of files from the backup. When those pathnames were resolved,\n pathname components that are symbolic links were traversed. An attacker\n that controlled a pathname component could replace it with a symbolic link,\n causing a privileged user to operate on a file other than the one intended.\n This could lead to the same kind of local privilege escalation as discussed\n before.\n This is fixed by using openat2(RESOLVE_NO_SYMLINKS) to resolve the\n directory components of a pathname, but see Compatibility Notes below for\n the details.\nMinor Issues Fixed:\n - When a symbolic link was specified on the command line but symbolic link\n traversal was disabled using option -P (--physical), the getfacl and\n setfacl utilities previously silently ignored the symlink. Now, an ELOOP\n (\"Too many levels of symbolic links\") error will result instead.\n - acl_delete_entry() now verifies that the specified entry belongs to the\n specified acl.\n - Numeric uids and gids that cannot be represented in types uid_t and gid_t\n are checked more carefully and invalid numbers are rejected.\n - Functions acl_get_file(), acl_get_file_at(), and acl_get_fd() will retry\n several times when the size of an ACL grows unexpectedly; previously, they\n only grew the allocated buffer once before giving up.\n - When passed a directory file descriptor, function perm_copy_fd() didn't\n copy the default ACL from one directory to the other. It now does.\n - setfacl --restore accidentally ignored leading whitespace in filenames. It\n no longer does.\n - setfacl --restore accidentally called chmod() when in --test mode. It no\n longer does.\n - When the setfattr --restore option was used multiple times, a buffer was\n accessed after being freed. This no longer happens.\n - When the setfattr -h (--no-dereference) option was given after --restore,\n it was ignored. Now, the options can be passed in any order.\n - The -h (--no-dereference) option of getfattr prevented getfattr from\n recursing into \"symbolic link directories\". This is wrong. When dirlink\n is a symbolic link that refers to a directory, \"getfattr -Rh dirlink\" will now\n visit that directory. The -P (--physical) option can be used to prevent\n that.\n - Similarly, when a symbolic link referring to a directory was specified on\n the getfacl or setfacl command line, the -R option did not cause that\n directory to be visited. This has been fixed so that those directories\n will now be visited. The -P (--physical) option can be used to prevent\n\nChanges for attr:\n\n- Update to 2.6.0 (jsc#PED-16501):\nMajor Issues Fixed:\n - The libacl library functions acl_get_file(), acl_set_file(),\n acl_extended_file(), and acl_delete_def_file() take a pathname argument\n and follow symbolic links. When a privileged user calls one of those\n functions, an attacker that controls a pathname component can replace a\n file or directory with a symbolic link and redirect the operation to a\n different file. This can lead to local privilege escalation.\n (CVE-2026-54369, bsc#1268867)\n The library functions cannot be fixed without breaking compatibility; the\n described behaviour is by design.\n Instead, version 2.4.0 of the acl package introduces the additional\n functions acl_get_file_at(), acl_set_file_at(), acl_extended_file_at(), and\n acl_delete_def_file_at(). These functions each take a dirfd file\n descriptor argument and an at_flags argument and accept the\n AT_SYMLINK_NOFOLLOW and AT_EMPTY_PATH flags. Use these functions to\n control when to follow symbolic links. (CVE-2026-54370, bsc#1268867)\n In addition, the libacl functions acl_get_fd(), acl_set_fd(), and\n acl_extended_fd() functions always operate on the access ACL; the library\n previously did not offer a way to operate on the default ACL of a directory\n file descriptor. The new functions remove that restriction.\n It will be up to each individual program to start using these new library\n functions where appropriate.\n - When walking directory trees, the getfacl, setfacl, chacl, and getfattr\n utilities constructed the full pathname of each file in the tree\nand use that\n pathname to access the file. When a privileged user used those utilities,\n an attacker that controlled a pathname component could replace a\ndirectory with\n a symbolic link and redirect the operation to a different file, leading to\n a local privilege escalation. (CVE-2026-54371, bsc#1268867)\n This is fixed by using directory file descriptors and operating relative to\n those directory file descriptors.\n - When resolving the final pathname component, the getfacl, setfacl, chacl,\n getfattr, and setfattr utilities in some cases used functions that resolve\n symbolic links. This includes the above mentioned libacl functions, but\n also stat(), chmod(), and chown().\n This is fixed by using symlink-safe functions throughout the code.\n - When restoring a backup, the setfacl and setfattr utilities read the full\n pathnames of files from the backup. When those pathnames were resolved,\n pathname components that are symbolic links were traversed. An attacker\n that controlled a pathname component could replace it with a symbolic link,\n causing a privileged user to operate on a file other than the one intended.\n This could lead to the same kind of local privilege escalation as discussed\n before.\n This is fixed by using openat2(RESOLVE_NO_SYMLINKS) to resolve the\n directory components of a pathname, but see Compatibility Notes below for\n the details.\nMinor Issues Fixed:\n - When a symbolic link was specified on the command line but symbolic link\n traversal was disabled using option -P (--physical), the getfacl and\n setfacl utilities previously silently ignored the symlink. Now, an ELOOP\n (\"Too many levels of symbolic links\") error will result instead.\n - acl_delete_entry() now verifies that the specified entry belongs to the\n specified acl.\n - Numeric uids and gids that cannot be represented in types uid_t and gid_t\n are checked more carefully and invalid numbers are rejected.\n - Functions acl_get_file(), acl_get_file_at(), and acl_get_fd() will retry\n several times when the size of an ACL grows unexpectedly; previously, they\n only grew the allocated buffer once before giving up.\n - When passed a directory file descriptor, function perm_copy_fd() didn't\n copy the default ACL from one directory to the other. It now does.\n - setfacl --restore accidentally ignored leading whitespace in filenames. It\n no longer does.\n - setfacl --restore accidentally called chmod() when in --test mode. It no\n longer does.\n - When the setfattr --restore option was used multiple times, a buffer was\n accessed after being freed. This no longer happens.\n - When the setfattr -h (--no-dereference) option was given after --restore,\n it was ignored. Now, the options can be passed in any order.\n - The -h (--no-dereference) option of getfattr prevented getfattr from\n recursing into \"symbolic link directories\". This is wrong. When dirlink\n is a symbolic link that refers to a directory, \"getfattr -Rh\ndirlink\" will now\n visit that directory. The -P (--physical) option can be used to prevent\n that.\n - Similarly, when a symbolic link referring to a directory was specified on\n the getfacl or setfacl command line, the -R option did not cause that\n directory to be visited. This has been fixed so that those directories\n will now be visited. The -P (--physical) option can be used to prevent\n","status":"published","published":"2026-09-11T11:46:37Z","modified":"2026-09-29T18:23:11.287779363Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"SUSE-SU-2026:23705-1","title":"Security update for acl, attr","description":"This update for acl, attr fixes the following issue:\n\n- CVE-2026-54369,CVE-2026-54370,CVE-2026-54371: Symlink Traversal Privilege Escalation via getfattr/setfattr,\n  getfacl/setfacl/chacl, libacl (bsc#1268867).\n\nChanges for acl:\n\n- Update to 2.4.0 (jsc#PED-16501):\n Major Issues Fixed:\n - The libacl library functions acl_get_file(), acl_set_file(),\n acl_extended_file(), and acl_delete_def_file() take a pathname argument\n and follow symbolic links. When a privileged user calls one of those\n functions, an attacker that controls a pathname component can replace a\n file or directory with a symbolic link and redirect the operation to a\n different file. This can lead to local privilege escalation.\n (CVE-2026-54369, bsc#1268867)\n The library functions cannot be fixed without breaking compatibility; the\n described behaviour is by design.\n Instead, version 2.4.0 of the acl package introduces the additional\n functions acl_get_file_at(), acl_set_file_at(), acl_extended_file_at(), and\n acl_delete_def_file_at(). These functions each take a dirfd file\n descriptor argument and an at_flags argument and accept the\n AT_SYMLINK_NOFOLLOW and AT_EMPTY_PATH flags. Use these functions to\n control when to follow symbolic links. (CVE-2026-54370, bsc#1268867)\n In addition, the libacl functions acl_get_fd(), acl_set_fd(), and\n acl_extended_fd() functions always operate on the access ACL; the library\n previously did not offer a way to operate on the default ACL of a directory\n file descriptor. The new functions remove that restriction.\n It will be up to each individual program to start using these new library\n functions where appropriate.\n - When walking directory trees, the getfacl, setfacl, chacl, and getfattr\n utilities constructed the full pathname of each file in the tree and use that\n pathname to access the file. When a privileged user used those utilities,\n an attacker that controlled a pathname component could replace a directory with\n a symbolic link and redirect the operation to a different file, leading to\n a local privilege escalation. (CVE-2026-54371, bsc#1268867)\n This is fixed by using directory file descriptors and operating relative to\n those directory file descriptors.\n - When resolving the final pathname component, the getfacl, setfacl, chacl,\n getfattr, and setfattr utilities in some cases used functions that resolve\n symbolic links. This includes the above mentioned libacl functions, but\n also stat(), chmod(), and chown().\n This is fixed by using symlink-safe functions throughout the code.\n - When restoring a backup, the setfacl and setfattr utilities read the full\n pathnames of files from the backup. When those pathnames were resolved,\n pathname components that are symbolic links were traversed. An attacker\n that controlled a pathname component could replace it with a symbolic link,\n causing a privileged user to operate on a file other than the one intended.\n This could lead to the same kind of local privilege escalation as discussed\n before.\n This is fixed by using openat2(RESOLVE_NO_SYMLINKS) to resolve the\n directory components of a pathname, but see Compatibility Notes below for\n the details.\nMinor Issues Fixed:\n - When a symbolic link was specified on the command line but symbolic link\n traversal was disabled using option -P (--physical), the getfacl and\n setfacl utilities previously silently ignored the symlink. Now, an ELOOP\n (\"Too many levels of symbolic links\") error will result instead.\n - acl_delete_entry() now verifies that the specified entry belongs to the\n specified acl.\n - Numeric uids and gids that cannot be represented in types uid_t and gid_t\n are checked more carefully and invalid numbers are rejected.\n - Functions acl_get_file(), acl_get_file_at(), and acl_get_fd() will retry\n several times when the size of an ACL grows unexpectedly; previously, they\n only grew the allocated buffer once before giving up.\n - When passed a directory file descriptor, function perm_copy_fd() didn't\n copy the default ACL from one directory to the other. It now does.\n - setfacl --restore accidentally ignored leading whitespace in filenames. It\n no longer does.\n - setfacl --restore accidentally called chmod() when in --test mode. It no\n longer does.\n - When the setfattr --restore option was used multiple times, a buffer was\n accessed after being freed. This no longer happens.\n - When the setfattr -h (--no-dereference) option was given after --restore,\n it was ignored. Now, the options can be passed in any order.\n - The -h (--no-dereference) option of getfattr prevented getfattr from\n recursing into \"symbolic link directories\". This is wrong. When dirlink\n is a symbolic link that refers to a directory, \"getfattr -Rh dirlink\" will now\n visit that directory. The -P (--physical) option can be used to prevent\n that.\n - Similarly, when a symbolic link referring to a directory was specified on\n the getfacl or setfacl command line, the -R option did not cause that\n directory to be visited. This has been fixed so that those directories\n will now be visited. The -P (--physical) option can be used to prevent\n\nChanges for attr:\n\n- Update to 2.6.0 (jsc#PED-16501):\nMajor Issues Fixed:\n - The libacl library functions acl_get_file(), acl_set_file(),\n acl_extended_file(), and acl_delete_def_file() take a pathname argument\n and follow symbolic links. When a privileged user calls one of those\n functions, an attacker that controls a pathname component can replace a\n file or directory with a symbolic link and redirect the operation to a\n different file. This can lead to local privilege escalation.\n (CVE-2026-54369, bsc#1268867)\n The library functions cannot be fixed without breaking compatibility; the\n described behaviour is by design.\n Instead, version 2.4.0 of the acl package introduces the additional\n functions acl_get_file_at(), acl_set_file_at(), acl_extended_file_at(), and\n acl_delete_def_file_at(). These functions each take a dirfd file\n descriptor argument and an at_flags argument and accept the\n AT_SYMLINK_NOFOLLOW and AT_EMPTY_PATH flags. Use these functions to\n control when to follow symbolic links. (CVE-2026-54370, bsc#1268867)\n In addition, the libacl functions acl_get_fd(), acl_set_fd(), and\n acl_extended_fd() functions always operate on the access ACL; the library\n previously did not offer a way to operate on the default ACL of a directory\n file descriptor. The new functions remove that restriction.\n It will be up to each individual program to start using these new library\n functions where appropriate.\n - When walking directory trees, the getfacl, setfacl, chacl, and getfattr\n utilities constructed the full pathname of each file in the tree\nand use that\n pathname to access the file. When a privileged user used those utilities,\n an attacker that controlled a pathname component could replace a\ndirectory with\n a symbolic link and redirect the operation to a different file, leading to\n a local privilege escalation. (CVE-2026-54371, bsc#1268867)\n This is fixed by using directory file descriptors and operating relative to\n those directory file descriptors.\n - When resolving the final pathname component, the getfacl, setfacl, chacl,\n getfattr, and setfattr utilities in some cases used functions that resolve\n symbolic links. This includes the above mentioned libacl functions, but\n also stat(), chmod(), and chown().\n This is fixed by using symlink-safe functions throughout the code.\n - When restoring a backup, the setfacl and setfattr utilities read the full\n pathnames of files from the backup. When those pathnames were resolved,\n pathname components that are symbolic links were traversed. An attacker\n that controlled a pathname component could replace it with a symbolic link,\n causing a privileged user to operate on a file other than the one intended.\n This could lead to the same kind of local privilege escalation as discussed\n before.\n This is fixed by using openat2(RESOLVE_NO_SYMLINKS) to resolve the\n directory components of a pathname, but see Compatibility Notes below for\n the details.\nMinor Issues Fixed:\n - When a symbolic link was specified on the command line but symbolic link\n traversal was disabled using option -P (--physical), the getfacl and\n setfacl utilities previously silently ignored the symlink. Now, an ELOOP\n (\"Too many levels of symbolic links\") error will result instead.\n - acl_delete_entry() now verifies that the specified entry belongs to the\n specified acl.\n - Numeric uids and gids that cannot be represented in types uid_t and gid_t\n are checked more carefully and invalid numbers are rejected.\n - Functions acl_get_file(), acl_get_file_at(), and acl_get_fd() will retry\n several times when the size of an ACL grows unexpectedly; previously, they\n only grew the allocated buffer once before giving up.\n - When passed a directory file descriptor, function perm_copy_fd() didn't\n copy the default ACL from one directory to the other. It now does.\n - setfacl --restore accidentally ignored leading whitespace in filenames. It\n no longer does.\n - setfacl --restore accidentally called chmod() when in --test mode. It no\n longer does.\n - When the setfattr --restore option was used multiple times, a buffer was\n accessed after being freed. This no longer happens.\n - When the setfattr -h (--no-dereference) option was given after --restore,\n it was ignored. Now, the options can be passed in any order.\n - The -h (--no-dereference) option of getfattr prevented getfattr from\n recursing into \"symbolic link directories\". This is wrong. When dirlink\n is a symbolic link that refers to a directory, \"getfattr -Rh\ndirlink\" will now\n visit that directory. The -P (--physical) option can be used to prevent\n that.\n - Similarly, when a symbolic link referring to a directory was specified on\n the getfacl or setfacl command line, the -R option did not cause that\n directory to be visited. This has been fixed so that those directories\n will now be visited. The -P (--physical) option can be used to prevent\n","status":"published","published":"2026-09-11T11:46:37Z","modified":"2026-09-29T18:23:21.320522192Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"SUSE-SU-2026:23726-1","title":"Security update for acl, attr","description":"This update for acl, attr fixes the following issue:\n\n- CVE-2026-54369,CVE-2026-54370,CVE-2026-54371: Symlink Traversal Privilege Escalation via getfattr/setfattr,\n  getfacl/setfacl/chacl, libacl (bsc#1268867).\n\nChanges for acl:\n\n- Update to 2.4.0 (jsc#PED-16501):\n Major Issues Fixed:\n - The libacl library functions acl_get_file(), acl_set_file(),\n acl_extended_file(), and acl_delete_def_file() take a pathname argument\n and follow symbolic links. When a privileged user calls one of those\n functions, an attacker that controls a pathname component can replace a\n file or directory with a symbolic link and redirect the operation to a\n different file. This can lead to local privilege escalation.\n (CVE-2026-54369, bsc#1268867)\n The library functions cannot be fixed without breaking compatibility; the\n described behaviour is by design.\n Instead, version 2.4.0 of the acl package introduces the additional\n functions acl_get_file_at(), acl_set_file_at(), acl_extended_file_at(), and\n acl_delete_def_file_at(). These functions each take a dirfd file\n descriptor argument and an at_flags argument and accept the\n AT_SYMLINK_NOFOLLOW and AT_EMPTY_PATH flags. Use these functions to\n control when to follow symbolic links. (CVE-2026-54370, bsc#1268867)\n In addition, the libacl functions acl_get_fd(), acl_set_fd(), and\n acl_extended_fd() functions always operate on the access ACL; the library\n previously did not offer a way to operate on the default ACL of a directory\n file descriptor. The new functions remove that restriction.\n It will be up to each individual program to start using these new library\n functions where appropriate.\n - When walking directory trees, the getfacl, setfacl, chacl, and getfattr\n utilities constructed the full pathname of each file in the tree and use that\n pathname to access the file. When a privileged user used those utilities,\n an attacker that controlled a pathname component could replace a directory with\n a symbolic link and redirect the operation to a different file, leading to\n a local privilege escalation. (CVE-2026-54371, bsc#1268867)\n This is fixed by using directory file descriptors and operating relative to\n those directory file descriptors.\n - When resolving the final pathname component, the getfacl, setfacl, chacl,\n getfattr, and setfattr utilities in some cases used functions that resolve\n symbolic links. This includes the above mentioned libacl functions, but\n also stat(), chmod(), and chown().\n This is fixed by using symlink-safe functions throughout the code.\n - When restoring a backup, the setfacl and setfattr utilities read the full\n pathnames of files from the backup. When those pathnames were resolved,\n pathname components that are symbolic links were traversed. An attacker\n that controlled a pathname component could replace it with a symbolic link,\n causing a privileged user to operate on a file other than the one intended.\n This could lead to the same kind of local privilege escalation as discussed\n before.\n This is fixed by using openat2(RESOLVE_NO_SYMLINKS) to resolve the\n directory components of a pathname, but see Compatibility Notes below for\n the details.\nMinor Issues Fixed:\n - When a symbolic link was specified on the command line but symbolic link\n traversal was disabled using option -P (--physical), the getfacl and\n setfacl utilities previously silently ignored the symlink. Now, an ELOOP\n (\"Too many levels of symbolic links\") error will result instead.\n - acl_delete_entry() now verifies that the specified entry belongs to the\n specified acl.\n - Numeric uids and gids that cannot be represented in types uid_t and gid_t\n are checked more carefully and invalid numbers are rejected.\n - Functions acl_get_file(), acl_get_file_at(), and acl_get_fd() will retry\n several times when the size of an ACL grows unexpectedly; previously, they\n only grew the allocated buffer once before giving up.\n - When passed a directory file descriptor, function perm_copy_fd() didn't\n copy the default ACL from one directory to the other. It now does.\n - setfacl --restore accidentally ignored leading whitespace in filenames. It\n no longer does.\n - setfacl --restore accidentally called chmod() when in --test mode. It no\n longer does.\n - When the setfattr --restore option was used multiple times, a buffer was\n accessed after being freed. This no longer happens.\n - When the setfattr -h (--no-dereference) option was given after --restore,\n it was ignored. Now, the options can be passed in any order.\n - The -h (--no-dereference) option of getfattr prevented getfattr from\n recursing into \"symbolic link directories\". This is wrong. When dirlink\n is a symbolic link that refers to a directory, \"getfattr -Rh dirlink\" will now\n visit that directory. The -P (--physical) option can be used to prevent\n that.\n - Similarly, when a symbolic link referring to a directory was specified on\n the getfacl or setfacl command line, the -R option did not cause that\n directory to be visited. This has been fixed so that those directories\n will now be visited. The -P (--physical) option can be used to prevent\n\nChanges for attr:\n\n- Update to 2.6.0 (jsc#PED-16501):\nMajor Issues Fixed:\n - The libacl library functions acl_get_file(), acl_set_file(),\n acl_extended_file(), and acl_delete_def_file() take a pathname argument\n and follow symbolic links. When a privileged user calls one of those\n functions, an attacker that controls a pathname component can replace a\n file or directory with a symbolic link and redirect the operation to a\n different file. This can lead to local privilege escalation.\n (CVE-2026-54369, bsc#1268867)\n The library functions cannot be fixed without breaking compatibility; the\n described behaviour is by design.\n Instead, version 2.4.0 of the acl package introduces the additional\n functions acl_get_file_at(), acl_set_file_at(), acl_extended_file_at(), and\n acl_delete_def_file_at(). These functions each take a dirfd file\n descriptor argument and an at_flags argument and accept the\n AT_SYMLINK_NOFOLLOW and AT_EMPTY_PATH flags. Use these functions to\n control when to follow symbolic links. (CVE-2026-54370, bsc#1268867)\n In addition, the libacl functions acl_get_fd(), acl_set_fd(), and\n acl_extended_fd() functions always operate on the access ACL; the library\n previously did not offer a way to operate on the default ACL of a directory\n file descriptor. The new functions remove that restriction.\n It will be up to each individual program to start using these new library\n functions where appropriate.\n - When walking directory trees, the getfacl, setfacl, chacl, and getfattr\n utilities constructed the full pathname of each file in the tree\nand use that\n pathname to access the file. When a privileged user used those utilities,\n an attacker that controlled a pathname component could replace a\ndirectory with\n a symbolic link and redirect the operation to a different file, leading to\n a local privilege escalation. (CVE-2026-54371, bsc#1268867)\n This is fixed by using directory file descriptors and operating relative to\n those directory file descriptors.\n - When resolving the final pathname component, the getfacl, setfacl, chacl,\n getfattr, and setfattr utilities in some cases used functions that resolve\n symbolic links. This includes the above mentioned libacl functions, but\n also stat(), chmod(), and chown().\n This is fixed by using symlink-safe functions throughout the code.\n - When restoring a backup, the setfacl and setfattr utilities read the full\n pathnames of files from the backup. When those pathnames were resolved,\n pathname components that are symbolic links were traversed. An attacker\n that controlled a pathname component could replace it with a symbolic link,\n causing a privileged user to operate on a file other than the one intended.\n This could lead to the same kind of local privilege escalation as discussed\n before.\n This is fixed by using openat2(RESOLVE_NO_SYMLINKS) to resolve the\n directory components of a pathname, but see Compatibility Notes below for\n the details.\nMinor Issues Fixed:\n - When a symbolic link was specified on the command line but symbolic link\n traversal was disabled using option -P (--physical), the getfacl and\n setfacl utilities previously silently ignored the symlink. Now, an ELOOP\n (\"Too many levels of symbolic links\") error will result instead.\n - acl_delete_entry() now verifies that the specified entry belongs to the\n specified acl.\n - Numeric uids and gids that cannot be represented in types uid_t and gid_t\n are checked more carefully and invalid numbers are rejected.\n - Functions acl_get_file(), acl_get_file_at(), and acl_get_fd() will retry\n several times when the size of an ACL grows unexpectedly; previously, they\n only grew the allocated buffer once before giving up.\n - When passed a directory file descriptor, function perm_copy_fd() didn't\n copy the default ACL from one directory to the other. It now does.\n - setfacl --restore accidentally ignored leading whitespace in filenames. It\n no longer does.\n - setfacl --restore accidentally called chmod() when in --test mode. It no\n longer does.\n - When the setfattr --restore option was used multiple times, a buffer was\n accessed after being freed. This no longer happens.\n - When the setfattr -h (--no-dereference) option was given after --restore,\n it was ignored. Now, the options can be passed in any order.\n - The -h (--no-dereference) option of getfattr prevented getfattr from\n recursing into \"symbolic link directories\". This is wrong. When dirlink\n is a symbolic link that refers to a directory, \"getfattr -Rh\ndirlink\" will now\n visit that directory. The -P (--physical) option can be used to prevent\n that.\n - Similarly, when a symbolic link referring to a directory was specified on\n the getfacl or setfacl command line, the -R option did not cause that\n directory to be visited. This has been fixed so that those directories\n will now be visited. The -P (--physical) option can be used to prevent\n","status":"published","published":"2026-09-11T11:46:37Z","modified":"2026-09-29T18:23:21.805931342Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"SUSE-SU-2026:4176-1","title":"Security update for acl, attr","description":"This update for acl, attr fixes the following issue:\n\n- CVE-2026-54369,CVE-2026-54370,CVE-2026-54371: Symlink Traversal Privilege Escalation via getfattr/setfattr,\n  getfacl/setfacl/chacl, libacl (bsc#1268867).\n\nChanges for acl:\n\n- Update to 2.4.0 (jsc#PED-16501):\n Major Issues Fixed:\n - The libacl library functions acl_get_file(), acl_set_file(),\n acl_extended_file(), and acl_delete_def_file() take a pathname argument\n and follow symbolic links. When a privileged user calls one of those\n functions, an attacker that controls a pathname component can replace a\n file or directory with a symbolic link and redirect the operation to a\n different file. This can lead to local privilege escalation.\n (CVE-2026-54369, bsc#1268867)\n The library functions cannot be fixed without breaking compatibility; the\n described behaviour is by design.\n Instead, version 2.4.0 of the acl package introduces the additional\n functions acl_get_file_at(), acl_set_file_at(), acl_extended_file_at(), and\n acl_delete_def_file_at(). These functions each take a dirfd file\n descriptor argument and an at_flags argument and accept the\n AT_SYMLINK_NOFOLLOW and AT_EMPTY_PATH flags. Use these functions to\n control when to follow symbolic links. (CVE-2026-54370, bsc#1268867)\n In addition, the libacl functions acl_get_fd(), acl_set_fd(), and\n acl_extended_fd() functions always operate on the access ACL; the library\n previously did not offer a way to operate on the default ACL of a directory\n file descriptor. The new functions remove that restriction.\n It will be up to each individual program to start using these new library\n functions where appropriate.\n - When walking directory trees, the getfacl, setfacl, chacl, and getfattr\n utilities constructed the full pathname of each file in the tree and use that\n pathname to access the file. When a privileged user used those utilities,\n an attacker that controlled a pathname component could replace a directory with\n a symbolic link and redirect the operation to a different file, leading to\n a local privilege escalation. (CVE-2026-54371, bsc#1268867)\n This is fixed by using directory file descriptors and operating relative to\n those directory file descriptors.\n - When resolving the final pathname component, the getfacl, setfacl, chacl,\n getfattr, and setfattr utilities in some cases used functions that resolve\n symbolic links. This includes the above mentioned libacl functions, but\n also stat(), chmod(), and chown().\n This is fixed by using symlink-safe functions throughout the code.\n - When restoring a backup, the setfacl and setfattr utilities read the full\n pathnames of files from the backup. When those pathnames were resolved,\n pathname components that are symbolic links were traversed. An attacker\n that controlled a pathname component could replace it with a symbolic link,\n causing a privileged user to operate on a file other than the one intended.\n This could lead to the same kind of local privilege escalation as discussed\n before.\n This is fixed by using openat2(RESOLVE_NO_SYMLINKS) to resolve the\n directory components of a pathname, but see Compatibility Notes below for\n the details.\nMinor Issues Fixed:\n - When a symbolic link was specified on the command line but symbolic link\n traversal was disabled using option -P (--physical), the getfacl and\n setfacl utilities previously silently ignored the symlink. Now, an ELOOP\n ('Too many levels of symbolic links') error will result instead.\n - acl_delete_entry() now verifies that the specified entry belongs to the\n specified acl.\n - Numeric uids and gids that cannot be represented in types uid_t and gid_t\n are checked more carefully and invalid numbers are rejected.\n - Functions acl_get_file(), acl_get_file_at(), and acl_get_fd() will retry\n several times when the size of an ACL grows unexpectedly; previously, they\n only grew the allocated buffer once before giving up.\n - When passed a directory file descriptor, function perm_copy_fd() didn't\n copy the default ACL from one directory to the other. It now does.\n - setfacl --restore accidentally ignored leading whitespace in filenames. It\n no longer does.\n - setfacl --restore accidentally called chmod() when in --test mode. It no\n longer does.\n - When the setfattr --restore option was used multiple times, a buffer was\n accessed after being freed. This no longer happens.\n - When the setfattr -h (--no-dereference) option was given after --restore,\n it was ignored. Now, the options can be passed in any order.\n - The -h (--no-dereference) option of getfattr prevented getfattr from\n recursing into 'symbolic link directories'. This is wrong. When dirlink\n is a symbolic link that refers to a directory, 'getfattr -Rh dirlink' will now\n visit that directory. The -P (--physical) option can be used to prevent\n that.\n - Similarly, when a symbolic link referring to a directory was specified on\n the getfacl or setfacl command line, the -R option did not cause that\n directory to be visited. This has been fixed so that those directories\n will now be visited. The -P (--physical) option can be used to prevent\n\nChanges for attr:\n\n- Update to 2.6.0 (jsc#PED-16501):\nMajor Issues Fixed:\n - The libacl library functions acl_get_file(), acl_set_file(),\n acl_extended_file(), and acl_delete_def_file() take a pathname argument\n and follow symbolic links. When a privileged user calls one of those\n functions, an attacker that controls a pathname component can replace a\n file or directory with a symbolic link and redirect the operation to a\n different file. This can lead to local privilege escalation.\n (CVE-2026-54369, bsc#1268867)\n The library functions cannot be fixed without breaking compatibility; the\n described behaviour is by design.\n Instead, version 2.4.0 of the acl package introduces the additional\n functions acl_get_file_at(), acl_set_file_at(), acl_extended_file_at(), and\n acl_delete_def_file_at(). These functions each take a dirfd file\n descriptor argument and an at_flags argument and accept the\n AT_SYMLINK_NOFOLLOW and AT_EMPTY_PATH flags. Use these functions to\n control when to follow symbolic links. (CVE-2026-54370, bsc#1268867)\n In addition, the libacl functions acl_get_fd(), acl_set_fd(), and\n acl_extended_fd() functions always operate on the access ACL; the library\n previously did not offer a way to operate on the default ACL of a directory\n file descriptor. The new functions remove that restriction.\n It will be up to each individual program to start using these new library\n functions where appropriate.\n - When walking directory trees, the getfacl, setfacl, chacl, and getfattr\n utilities constructed the full pathname of each file in the tree\nand use that\n pathname to access the file. When a privileged user used those utilities,\n an attacker that controlled a pathname component could replace a\ndirectory with\n a symbolic link and redirect the operation to a different file, leading to\n a local privilege escalation. (CVE-2026-54371, bsc#1268867)\n This is fixed by using directory file descriptors and operating relative to\n those directory file descriptors.\n - When resolving the final pathname component, the getfacl, setfacl, chacl,\n getfattr, and setfattr utilities in some cases used functions that resolve\n symbolic links. This includes the above mentioned libacl functions, but\n also stat(), chmod(), and chown().\n This is fixed by using symlink-safe functions throughout the code.\n - When restoring a backup, the setfacl and setfattr utilities read the full\n pathnames of files from the backup. When those pathnames were resolved,\n pathname components that are symbolic links were traversed. An attacker\n that controlled a pathname component could replace it with a symbolic link,\n causing a privileged user to operate on a file other than the one intended.\n This could lead to the same kind of local privilege escalation as discussed\n before.\n This is fixed by using openat2(RESOLVE_NO_SYMLINKS) to resolve the\n directory components of a pathname, but see Compatibility Notes below for\n the details.\nMinor Issues Fixed:\n - When a symbolic link was specified on the command line but symbolic link\n traversal was disabled using option -P (--physical), the getfacl and\n setfacl utilities previously silently ignored the symlink. Now, an ELOOP\n ('Too many levels of symbolic links') error will result instead.\n - acl_delete_entry() now verifies that the specified entry belongs to the\n specified acl.\n - Numeric uids and gids that cannot be represented in types uid_t and gid_t\n are checked more carefully and invalid numbers are rejected.\n - Functions acl_get_file(), acl_get_file_at(), and acl_get_fd() will retry\n several times when the size of an ACL grows unexpectedly; previously, they\n only grew the allocated buffer once before giving up.\n - When passed a directory file descriptor, function perm_copy_fd() didn't\n copy the default ACL from one directory to the other. It now does.\n - setfacl --restore accidentally ignored leading whitespace in filenames. It\n no longer does.\n - setfacl --restore accidentally called chmod() when in --test mode. It no\n longer does.\n - When the setfattr --restore option was used multiple times, a buffer was\n accessed after being freed. This no longer happens.\n - When the setfattr -h (--no-dereference) option was given after --restore,\n it was ignored. Now, the options can be passed in any order.\n - The -h (--no-dereference) option of getfattr prevented getfattr from\n recursing into 'symbolic link directories'. This is wrong. When dirlink\n is a symbolic link that refers to a directory, 'getfattr -Rh\ndirlink' will now\n visit that directory. The -P (--physical) option can be used to prevent\n that.\n - Similarly, when a symbolic link referring to a directory was specified on\n the getfacl or setfacl command line, the -R option did not cause that\n directory to be visited. This has been fixed so that those directories\n will now be visited. The -P (--physical) option can be used to prevent\n- update to 2.5.2:\n * attr: eliminate a dead store in attr_copy_action()\n * libattr: Set symbol versions for legacy syscalls via attribute\n or asm\n * exports: use LGPL for library code\n * documentation updates\n * translation updates (Polish, Dutch, Gregorian, French)\n * build system updates\n","status":"published","published":"2026-09-14T10:30:55Z","modified":"2026-09-15T17:00:05.449538893Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"USN-8691-1","title":"attr vulnerability","description":"It was discovered that attr incorrectly handled symbolic links while\ntraversing directory paths. A local attacker who controlled a pathname\ncomponent could possibly use this issue to redirect privileged attr\noperations to arbitrary files and gain elevated privileges.","status":"published","published":"2026-08-31T10:06:35Z","modified":"2026-08-31T22:26:26.842826826Z","updated_at":"2026-11-02T16:58:26.907654Z"}]}}