CVE-2026-54370: ACL TOCTOU Privilege Escalation Flaw

CVE-2026-54370 Overview

CVE-2026-54370 is a time-of-check to time-of-use (TOCTOU) race condition in the acl package before version 2.4.0. The flaw affects the getfacl, setfacl, and chacl utilities that manage POSIX file access control lists on Linux systems. A local attacker who controls a component of a pathname can replace it with a symbolic link between the initial lstat() check and follow-up symlink-following operations such as stat(), chown(), chmod(), acl_get_file(), and acl_set_file(). When a privileged process invokes these utilities over an attacker-controlled path, the operation is redirected to arbitrary files, resulting in local privilege escalation. The weakness is tracked as [CWE-367].

Critical Impact
Local attackers can escalate to root by racing ACL utilities into modifying ownership or permissions of files outside the intended path.

Affected Products

acl utilities before version 2.4.0
getfacl, setfacl, and chacl command-line tools
Linux distributions packaging vulnerable acl releases

Discovery Timeline

2026-06-29 - CVE-2026-54370 published to NVD
2026-06-29 - Last updated in NVD database

Technical Details for CVE-2026-54370

Vulnerability Analysis

The acl utilities walk pathnames to apply access control list changes recursively. During traversal, the code first calls lstat() to inspect a path component and decide whether to follow it. It then invokes symlink-following syscalls such as stat(), chown(), chmod(), acl_get_file(), and acl_set_file() on the same textual path. Between these two operations, the filesystem state can change. An unprivileged user who owns an intermediate directory can swap a benign entry for a symbolic link pointing to a sensitive target such as /etc/shadow or a root-owned binary.

When getfacl, setfacl, or chacl runs under a privileged context, for example through sudo, a cron job, or a backup script traversing user-writable directories, the second syscall follows the attacker-placed symlink. The ACL change or ownership update is then applied to the redirected target with the caller's elevated privileges.

Root Cause

The root cause is reliance on pathname-based syscalls across a check-then-use window. The acl code did not open directories with O_NOFOLLOW or operate on file descriptors using *at() variants such as fstatat() and fchownat() with AT_SYMLINK_NOFOLLOW. This left a race window that a local user could win by monitoring inotify events and swapping directory entries with rename().

Attack Vector

Exploitation requires local access and low privileges. The attacker prepares a directory tree under their control, then triggers or waits for a privileged process to run setfacl -R or chacl -R across that tree. During recursion, the attacker replaces a subdirectory with a symlink to a target such as /etc or a SUID binary. Winning the race causes the privileged utility to modify ownership, permissions, or ACLs on the target, enabling privilege escalation to root. The upstream fix is delivered in commits 24a227d0 and 3589787c.

Detection Methods for CVE-2026-54370

Indicators of Compromise

Unexpected ownership or permission changes on root-owned files such as /etc/shadow, /etc/passwd, or SUID binaries.
Symbolic links created inside directories that are traversed by privileged ACL operations.
setfacl or chacl invocations by root against paths located under user-writable parents.

Detection Strategies

Audit execve events for getfacl, setfacl, and chacl running as root over paths in /home, /tmp, or /var/tmp using auditd or eBPF-based sensors.
Correlate rename() and symlink() syscalls issued by unprivileged users with concurrent ACL utility execution by privileged processes.
Baseline file ownership on sensitive system paths and alert on drift outside package management events.

Monitoring Recommendations

Enable auditd rules for chown, chmod, and setxattr calls with auid>=1000 targets that resolve to system directories.
Log recursive ACL operations executed by privileged users and review them during shift handover.
Alert on new symlinks appearing in directories immediately before a privileged ACL job runs.

How to Mitigate CVE-2026-54370

Immediate Actions Required

Upgrade the acl package to version 2.4.0 or later on all Linux hosts.
Restrict recursive setfacl and chacl operations against user-controlled directories until patched.
Review scheduled tasks, backup scripts, and configuration management modules that invoke ACL utilities under root.

Patch Information

Upstream maintainers addressed the flaw in the acl 2.4.0 release. The fixes replace pathname-based syscalls with file-descriptor-based *at() variants and add O_NOFOLLOW semantics along the traversal. Distribution advisories and rebuilt packages should be tracked through the VulnCheck advisory and vendor channels.

Workarounds

Avoid running setfacl -R or chacl -R against directories writable by untrusted local users until the patch is applied.
Use find ... -xdev -type f -print0 | xargs -0 setfacl patterns that resolve paths under controlled conditions, or restrict operations to root-owned trees.
Enforce strict permissions on parent directories to remove attacker control over pathname components traversed by privileged jobs.

bash

# Verify installed acl version and upgrade
dpkg -l | grep '^ii  acl '        # Debian/Ubuntu
rpm -q acl                        # RHEL/Fedora/SUSE

# Apply vendor updates
sudo apt-get update && sudo apt-get install --only-upgrade acl
sudo dnf update acl