CVE-2026-54369: libacl Privilege Escalation Vulnerability

CVE-2026-54369 Overview

CVE-2026-54369 is a symlink traversal vulnerability in the acl library before version 2.4.0. The flaw affects the libacl pathname-based functions acl_get_file(), acl_set_file(), acl_extended_file(), and acl_delete_def_file(). Local attackers who control any component of a pathname processed by a privileged caller can substitute that component with a symbolic link. This redirects Access Control List (ACL) read or write operations to arbitrary files or directories. The result is unauthorized ACL manipulation and local privilege escalation on affected Linux systems. The issue maps to CWE-59: Improper Link Resolution Before File Access.

Critical Impact
A local attacker with limited privileges can hijack ACL operations performed by privileged processes to alter permissions on arbitrary files, achieving local privilege escalation.

Affected Products

acl library (libacl) versions prior to 2.4.0
Red Hat Enterprise Linux distributions shipping vulnerable libacl (see RHSA-2026:34351)
Linux distributions and utilities that link against libacl and invoke the affected pathname-based functions from privileged contexts

Discovery Timeline

2026-06-29 - CVE-2026-54369 published to the National Vulnerability Database (NVD)
2026-07-02 - Last updated in NVD database

Technical Details for CVE-2026-54369

Vulnerability Analysis

The libacl library exposes pathname-based helpers that resolve file paths and then perform ACL operations against the resolved target. The affected functions acl_get_file(), acl_set_file(), acl_extended_file(), and acl_delete_def_file() accept a caller-supplied path and follow symbolic links during resolution. When a privileged program calls these functions on a path that traverses attacker-controlled directories, the attacker can replace a component with a symlink pointing to a sensitive target. The privileged caller then reads or writes ACLs on the substituted target rather than the intended file.

This is a classic file-system trust boundary failure. The library does not enforce O_NOFOLLOW semantics or use *at() variants with proper flag handling to prevent link traversal during ACL operations. Successful exploitation can grant an unprivileged user write access to root-owned files or remove ACL entries that gate access to sensitive resources.

Root Cause

The root cause is unsafe link resolution inside libacl's pathname-based API. The functions resolve the full path via the kernel's default follow semantics before applying getxattr/setxattr operations for system.posix_acl_access and system.posix_acl_default. Any symlink placed in the path is transparently followed, so the ACL operation lands on a file chosen by an attacker who controls any writable directory component.

Attack Vector

Exploitation requires local access and low privileges. The attacker must control at least one directory component that a privileged process passes to a libacl pathname function. Typical scenarios involve setuid utilities, backup tools, package managers, or system services that call setfacl/getfacl (or equivalents) against paths located in user-writable areas such as /tmp, home directories, or shared spool directories. The attacker races or pre-positions a symlink so the privileged process performs the ACL write against a target such as /etc/shadow or a root-owned configuration file. See the VulnCheck Security Advisory for further technical context.

No verified public exploit code is available. The fix is captured in the upstream patches 24a227d0 and 3589787c.

Detection Methods for CVE-2026-54369

Indicators of Compromise

Unexpected ACL entries on sensitive files such as /etc/shadow, /etc/sudoers, /etc/passwd, or files under /root, discoverable with getfacl audits.
Symbolic links placed in user-writable directories that resolve to root-owned or ACL-protected system files.
Audit records showing setxattr or removexattr syscalls targeting system.posix_acl_access or system.posix_acl_default on files the invoking user should not modify.

Detection Strategies

Enable Linux audit rules on setxattr, lsetxattr, fsetxattr, removexattr, and chmod syscalls to capture ACL modifications performed by privileged processes on paths that traverse user-writable directories.
Package inventory checks: query rpm -q acl, dpkg -l acl, or equivalent to identify hosts running libacl versions older than 2.4.0.
Correlate execution of setuid binaries and system services that invoke setfacl/getfacl with subsequent ACL changes on unrelated sensitive files.

Monitoring Recommendations

Baseline ACLs on critical files and alert on drift using file integrity monitoring.
Log and review all invocations of setfacl, chacl, and services that operate on user-supplied paths while running as root.
Monitor creation of symbolic links in world-writable directories that resolve outside the creating user's ownership scope.

How to Mitigate CVE-2026-54369

Immediate Actions Required

Upgrade the acl package to version 2.4.0 or the vendor-backported equivalent on all Linux hosts.
On Red Hat systems, apply the fixes published in RHSA-2026:34351 and consult the Red Hat CVE page for distribution-specific guidance.
Audit privileged scripts and services that call setfacl/getfacl against paths under user-writable directories and refactor them to use file-descriptor-based operations.

Patch Information

Upstream fixes are available in the acl repository via commits 24a227d0ab8576612194f8a56c2314389adc74a5 and 3589787cd589b34bdd9265936e17190b6d3f17d1. Distribution vendors have published rebuilt packages; Red Hat's advisory is tracked in Bugzilla 2490277 with a machine-readable CSAF VEX document.

Workarounds

Restrict use of setuid or root-invoked utilities that operate on paths inside user-writable directories until patches are applied.
Set the fs.protected_symlinks sysctl to 1 to reduce, but not eliminate, symlink-based attacks in sticky directories such as /tmp.
Avoid passing user-controlled or partially user-controlled paths to libacl pathname-based functions in custom software; use openat() with O_NOFOLLOW and file-descriptor-based ACL APIs where available.

bash

# Verify installed acl version and confirm patched release
rpm -q acl                     # RHEL/Fedora
dpkg -s acl | grep Version     # Debian/Ubuntu

# Enable kernel symlink protections as a defense-in-depth measure
sysctl -w fs.protected_symlinks=1
sysctl -w fs.protected_hardlinks=1
echo 'fs.protected_symlinks=1' >> /etc/sysctl.d/99-hardening.conf
echo 'fs.protected_hardlinks=1' >> /etc/sysctl.d/99-hardening.conf