CVE-2026-54370: ACL Race Condition Privilege Escalation Vulnerability

Technical summary

CVE-2026-54370 is a TOCTOU (time-of-check to time-of-use) race condition in the acl library's handling of symbolic links. The vulnerability occurs because the library calls lstat() to validate permissions on a path component, then later performs operations—including stat(), chown(), chmod(), acl_get_file(), or acl_set_file()—that follow symbolic links. An attacker with control over a pathname component in the attack surface can replace that component with a symlink between the validation and the operation, redirecting the privileged operation to an attacker-controlled file. This is a classic symlink attack pattern enabled by the window between security checks and actual file system operations. The race condition requires precise timing but is feasible in typical system configurations.

Business impact

Organizations running privileged processes that invoke acl utilities (getfacl, setfacl, chacl) over attacker-influenced paths face local privilege escalation risk. The impact is most severe in multi-user systems, shared hosting environments, and containerized deployments where unprivileged users can influence pathname inputs or monitor filesystem activity. A successful exploit allows an attacker to read sensitive file metadata, modify access control lists on system or user files, or expose confidential information protected by file permissions. While the attack requires local access and medium complexity execution, the outcome is substantial privilege elevation.

Affected systems

The acl package versions prior to 2.4.0 are affected. This includes POSIX ACL tools commonly found on Linux systems. The vulnerability is most relevant to systems where getfacl, setfacl, or chacl are executed with elevated privileges (via sudo, as root in scripts, or within privileged daemon processes) over paths that untrusted users can influence or monitor. Typical affected scenarios include system administration scripts, automated backup tools that preserve ACLs, and permission management workflows.

Exploitability

Exploiting this vulnerability requires local system access and the ability to monitor or influence filesystem operations in real time. The attacker must achieve precise timing to swap a symlink into place between the library's permission check and the subsequent file operation. The CVSS vector (AC:H) reflects the high complexity of the attack—it is not trivial, but feasible with careful coordination, particularly on systems with predictable I/O patterns or in controlled lab environments. Exploitation is not wormable or remotely exploitable; it remains strictly local.

Remediation

Upgrade the acl package to version 2.4.0 or later. Verify the version installed via your distribution's package manager (e.g., dpkg -l acl on Debian/Ubuntu, rpm -q acl on RHEL/CentOS). After upgrading, confirm that any scripts or automated processes invoking acl utilities continue to function as expected. Organizations should prioritize this update for systems where privileged processes operate on user-supplied or attacker-influenced paths.

Patch guidance

Apply the upgrade to acl 2.4.0 or later through your operating system's package manager. On Debian/Ubuntu, use apt-get update && apt-get upgrade acl. On RHEL/CentOS, use yum update acl or dnf upgrade acl. Verify the installed version matches or exceeds 2.4.0. Test any automation or scripts that depend on acl utilities after patching to ensure compatibility. If you maintain software that bundles acl, verify the upstream library version in your build.

Detection guidance

Monitor process execution logs (via auditd, syslog, or EDR tools) for invocations of getfacl, setfacl, and chacl, particularly when run with elevated privileges or over unusual paths. Use filesystem auditing (auditctl or fanotify) to detect rapid symlink creation and replacement in temporary or user-writable directories coinciding with acl utility execution. Review system logs for permission changes or file access anomalies following suspicious getfacl/setfacl calls. On high-value systems, consider process whitelisting or explicit approval workflows for privileged acl operations.

Why prioritize this

Although the CVSS score is MEDIUM (6.3), this vulnerability warrants prompt attention on multi-user systems and shared infrastructure. The flaw directly enables privilege escalation from unprivileged to privileged contexts, which violates core security boundaries. The complexity barrier (AC:H) makes opportunistic exploitation unlikely but targeted or environment-specific exploitation plausible. Prioritize patching systems where acl utilities are invoked by system services or scheduled tasks over attacker-controlled paths.

Risk score, explained

The CVSS 3.1 score of 6.3 (MEDIUM) reflects: local-only attack vector (AV:L), high complexity requiring race condition timing (AC:H), low privilege requirement (PR:L), no user interaction needed (UI:N), unchanged scope (S:U), high confidentiality impact (C:H—reading sensitive ACL metadata), high integrity impact (I:H—modifying file ACLs), and no availability impact (A:N). The high complexity ceiling prevents a critical score despite the privilege escalation outcome, because reliable exploitation requires precise environmental conditions and timing. In practice, the actual risk may vary significantly based on deployment posture.

Frequently asked questions