CVE-2026-54370: acl < 2.4.0 TOCTOU Symlink Traversal via getfacl/setfacl/chacl
acl before version 2.4.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability that allows local attackers to escalate privileges by replacing a pathname component with a symbolic link between an lstat() check and subsequent symlink-following operations such as stat(), chown(), chmod(), aclgetfile(), and aclsetfile(). Attackers who control a pathname component can redirect file access control list operations to arbitrary files when getfacl or setfacl is invoked by a privileged process over an attacker-controlled path, resulting in local privilege escalation.
Other sources
acl before version 2.4.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability that allows local attackers to escalate privileges by replacing a pathname component with a symbolic link between an lstat() check and subsequent symlink-following operations such as stat(), chown(), chmod(), aclgetfile(), and aclsetfile(). Attackers who control a pathname component can redirect file access control list operations to arbitrary files when getfacl, setfacl, or chacl is invoked by a privileged process over an attacker-controlled path, resulting in local privilege escalation.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
aclto a version that resolves this vulnerability.Fixed in 2.4.0 - Compensating control
When invoking privileged ACL operations (getfacl/setfacl/chacl), ensure the target path is not attacker-controlled—e.g., resolve/validate the full pathname before use and prevent symlink/pathname component substitution (TOCTOU) so that the privileged process cannot be redirected to arbitrary files.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-54370?
The severity of CVE-2026-54370 is medium with a score of 6.3.
How do I fix CVE-2026-54370?
To fix CVE-2026-54370, update the acl software to version 2.4.0 or later.
What type of vulnerability is associated with CVE-2026-54370?
CVE-2026-54370 is a time-of-check to time-of-use (TOCTOU) race condition vulnerability.
Who can be affected by CVE-2026-54370?
Local attackers can exploit CVE-2026-54370 to escalate privileges.
What operations are impacted by CVE-2026-54370?
CVE-2026-54370 affects operations such as stat(), chown(), and others that follow symbolic links.