RHSA-2026:60226: Moderate: attr security update

Q: What components should be updated to address this issue?

Update the affected attr package set, which includes attr, libattr, libattr-devel, and the associated debuginfo and debugsource packages where installed.

Q: What kind of access would an attacker need to exploit this vulnerability?

The issue is described as a symlink traversal privilege-escalation flaw involving getfattr and setfattr. The provided advisory does not specify the required local access level, affected configurations, or additional exploitation prerequisites.

Published Aug 26, 2026

Updated

Moderate: attr security update

Other sources

The attr packages provide extended attributes, which can be used to store system objects like capabilities of executables and access control lists, as well as user objects.Security Fix(es): attr: Symlink Traversal Privilege Escalation via getfattr and setfattr (CVE-2026-54371) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

— Red Hat

Affected Software

40 affected componentsFixes available

Red Hat Red Hat Enterprise Linux for x86_64

Red Hat Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions

Red Hat Red Hat Enterprise Linux for IBM z Systems - Extended Update Support

Red Hat Red Hat Enterprise Linux for Power, little endian

Red Hat Red Hat Enterprise Linux for ARM 64 - Extended Update Support

Red Hat Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle

Red Hat Red Hat Enterprise Linux for ARM 64

Red Hat Red Hat Enterprise Linux for Power, little endian - Extended Update Support

Red Hat Red Hat Enterprise Linux for IBM z Systems - 4 years of updates

Red Hat Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle

Red Hat Red Hat Enterprise Linux for IBM z Systems

Red Hat Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions

Red Hat Red Hat Enterprise Linux for x86_64 - Extended Life Cycle

Red Hat Red Hat Enterprise Linux for x86_64 - Extended Update Support

Red Hat Red Hat Enterprise Linux for ARM 64 - 4 years of updates

Red Hat Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle

redhat/attr<2.6.0-1.el9_8

2.6.0-1.el9_8

redhat/attr<2.6.0-1.el9_8

2.6.0-1.el9_8

redhat/attr-debuginfo<2.6.0-1.el9_8

2.6.0-1.el9_8

redhat/attr-debuginfo<2.6.0-1.el9_8

2.6.0-1.el9_8

redhat/attr-debugsource<2.6.0-1.el9_8

2.6.0-1.el9_8

redhat/attr-debugsource<2.6.0-1.el9_8

2.6.0-1.el9_8

redhat/libattr<2.6.0-1.el9_8

2.6.0-1.el9_8

redhat/libattr<2.6.0-1.el9_8

2.6.0-1.el9_8

redhat/libattr-debuginfo<2.6.0-1.el9_8

2.6.0-1.el9_8

redhat/libattr-debuginfo<2.6.0-1.el9_8

2.6.0-1.el9_8

redhat/libattr-devel<2.6.0-1.el9_8

2.6.0-1.el9_8

redhat/libattr-devel<2.6.0-1.el9_8

2.6.0-1.el9_8

redhat/attr<2.6.0-1.el9_8

2.6.0-1.el9_8

redhat/attr-debuginfo<2.6.0-1.el9_8

2.6.0-1.el9_8

redhat/attr-debugsource<2.6.0-1.el9_8

2.6.0-1.el9_8

redhat/libattr<2.6.0-1.el9_8

2.6.0-1.el9_8

redhat/libattr-debuginfo<2.6.0-1.el9_8

2.6.0-1.el9_8

redhat/libattr-devel<2.6.0-1.el9_8

2.6.0-1.el9_8

redhat/attr<2.6.0-1.el9_8.aa

2.6.0-1.el9_8.aa

redhat/attr-debuginfo<2.6.0-1.el9_8.aa

2.6.0-1.el9_8.aa

redhat/attr-debugsource<2.6.0-1.el9_8.aa

2.6.0-1.el9_8.aa

redhat/libattr<2.6.0-1.el9_8.aa

2.6.0-1.el9_8.aa

redhat/libattr-debuginfo<2.6.0-1.el9_8.aa

2.6.0-1.el9_8.aa

redhat/libattr-devel<2.6.0-1.el9_8.aa

2.6.0-1.el9_8.aa

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade redhat/attr to a version that resolves this vulnerability.
Fixed in 2.6.0-1.el9_8
Upgrade
Upgrade redhat/attr-debuginfo to a version that resolves this vulnerability.
Fixed in 2.6.0-1.el9_8
Upgrade
Upgrade redhat/attr-debugsource to a version that resolves this vulnerability.
Fixed in 2.6.0-1.el9_8
Upgrade
Upgrade redhat/libattr to a version that resolves this vulnerability.
Fixed in 2.6.0-1.el9_8
Upgrade
Upgrade redhat/libattr-debuginfo to a version that resolves this vulnerability.
Fixed in 2.6.0-1.el9_8
Upgrade
Upgrade redhat/libattr-devel to a version that resolves this vulnerability.
Fixed in 2.6.0-1.el9_8
Upgrade
Upgrade redhat/attr to a version that resolves this vulnerability.
Fixed in 2.6.0-1.el9_8.aa
Upgrade
Upgrade redhat/attr-debuginfo to a version that resolves this vulnerability.
Fixed in 2.6.0-1.el9_8.aa
Upgrade
Upgrade redhat/attr-debugsource to a version that resolves this vulnerability.
Fixed in 2.6.0-1.el9_8.aa
Upgrade
Upgrade redhat/libattr to a version that resolves this vulnerability.
Fixed in 2.6.0-1.el9_8.aa
Upgrade
Upgrade redhat/libattr-debuginfo to a version that resolves this vulnerability.
Fixed in 2.6.0-1.el9_8.aa
Upgrade
Upgrade redhat/libattr-devel to a version that resolves this vulnerability.
Fixed in 2.6.0-1.el9_8.aa

Event History

Aug 26, 2026

Advisory Published

via Red Hat·12:00 AM

Data Sourced

via Red Hat·12:00 AM

RemedyDescriptionAffected Software

Advisory Published

via Red Hat·10:11 AM

Data Sourced

via Red Hat·10:11 AM

Severity

Frequently Asked Questions

What components should be updated to address this issue?

Update the affected attr package set, which includes attr, libattr, libattr-devel, and the associated debuginfo and debugsource packages where installed.

What kind of access would an attacker need to exploit this vulnerability?

The issue is described as a symlink traversal privilege-escalation flaw involving getfattr and setfattr. The provided advisory does not specify the required local access level, affected configurations, or additional exploitation prerequisites.

RHSA-2026:60226: Moderate: attr security update

Other sources

Affected Software

Remediation

Event History

Frequently Asked Questions

What components should be updated to address this issue?

What kind of access would an attacker need to exploit this vulnerability?

Company

Resources

Contact

Frequently Asked Questions

What components should be updated to address this issue?

What kind of access would an attacker need to exploit this vulnerability?