CVE-2026-49421: unlinkat(2) ignores AT_RESOLVE_BENEATH flag
The kernel function that implements unlinkat(2) and funlinkat(2) validated the ATRESOLVEBENEATH flag but failed to pass it through to the underlying path lookup. The flag was silently dropped, so path resolution was not actually restricted.
A process that uses ATRESOLVEBENEATH with unlinkat(2) or funlinkat(2) to confine path resolution can in fact resolve paths above the starting directory. A caller relying on this flag for path containment may delete files outside the intended directory tree.
Affected Software
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications or services that use unlinkat(2) or funlinkat(2) with AT_RESOLVE_BENEATH as a security boundary for restricting deletions to a starting directory are exposed. Calls that do not rely on this flag for path containment are not described as affected.
What is required for exploitation?
The affected process must use AT_RESOLVE_BENEATH with unlinkat(2) or funlinkat(2) and rely on it to prevent paths from resolving above the starting directory. A path that resolves outside the intended directory tree can then cause deletion of files outside that tree.
How can I identify potentially affected code?
Review code and deployed applications for calls to unlinkat(2) or funlinkat(2) that pass AT_RESOLVE_BENEATH. Treat uses where the flag is intended to confine deletion operations to a directory tree as potentially affected.