CVE-2026-32282: TOCTOU permits root escape on Linux via Root.Chmod in os in internal/syscall/unix
On Linux, if the target of Root.Chmod is replaced with a symlink while the chmod operation is in progress, Chmod can operate on the target of the symlink, even when the target lies outside the root. The Linux fchmodat syscall silently ignores the ATSYMLINKNOFOLLOW flag, which Root.Chmod uses to avoid symlink traversal. Root.Chmod checks its target before acting and returns an error if the target is a symlink lying outside the root, so the impact is limited to cases where the target is replaced with a symlink between the check and operation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Prevent untrusted replacement of filesystem objects that Root.Chmod will operate on. Restrict write/rename/create permissions in directories where your application calls Root.Chmod so only trusted accounts/processes can replace files or create symlinks (e.g., tighten filesystem permissions, ACLs, or container policies).
- Operational
Audit your codebase for uses of Root.Chmod (os/internal/syscall/unix Root.Chmod) and either avoid calling it on untrusted inputs or ensure exclusive control of the file during the operation (serialize/chlock/obtain application-level locks) to eliminate the window where the target could be replaced by a symlink between the pre-check and the chmod.
- Operational
If an environment allows potential TOCTOU races (multiple actors can replace files), treat calls to Root.Chmod on Linux as unsafe until a platform/library fix is available: add additional validation after the syscall (verify intended target permissions/ownership) and monitor for unexpected symlink-targeted changes to detect exploitation attempts.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-32282?
CVE-2026-32282 has a high severity due to the potential for root escape on Linux systems.
How do I fix CVE-2026-32282?
To mitigate CVE-2026-32282, ensure that you upgrade the Go standard library to a version beyond 1.25.9 or between 1.26.0 and 1.26.2.
Which versions of the Go standard library are affected by CVE-2026-32282?
CVE-2026-32282 affects Go standard library versions up to 1.25.9 and between 1.26.0 and 1.26.2.
What is TOCTOU in the context of CVE-2026-32282?
TOCTOU stands for Time-of-Check to Time-of-Use, which enables the vulnerability when a symlink is manipulated during a chmod operation.
What systems are primarily at risk from CVE-2026-32282?
Primarily, Linux systems using the affected versions of the Go standard library are at risk from CVE-2026-32282.