CVE-2026-54371: attr Privilege Escalation Vulnerability

CVE-2026-54371 Overview

CVE-2026-54371 is a symlink traversal vulnerability [CWE-59] affecting the GNU attr package before version 2.6.0. The flaw resides in the getfattr and setfattr utilities, which traverse directory hierarchies without safely resolving pathname components. A local attacker who controls any component of a path can substitute a symbolic link during traversal. When a privileged process invokes getfattr or setfattr over an attacker-controlled path, the operation follows the symlink to an arbitrary file. This redirection enables local privilege escalation by allowing extended attribute reads or writes on files outside the intended target.

Critical Impact
Local attackers can escalate privileges when privileged processes run getfattr or setfattr over paths containing attacker-controlled components.

Affected Products

GNU attr package before version 2.6.0
getfattr utility (extended attribute reader)
setfattr utility (extended attribute writer)

Discovery Timeline

2026-06-29 - CVE-2026-54371 published to NVD
2026-06-30 - Last updated in NVD database

Technical Details for CVE-2026-54371

Vulnerability Analysis

The attr package provides command-line utilities for manipulating extended file attributes on Linux filesystems. Both getfattr and setfattr support recursive operation via the -R flag, walking directory hierarchies to apply operations to each entry. The recursive traversal logic in versions before 2.6.0 does not adequately protect against symlink substitution during walk. An attacker with write access to any directory in the traversal path can replace a subdirectory or file with a symbolic link between the time the tool enumerates the path and the time it acts on that component. This time-of-check to time-of-use pattern allows the utility to follow the symlink to a target outside the intended tree.

When root or another privileged user runs these tools over an attacker-writable location, extended attributes such as security.capability, system.posix_acl_access, or SELinux labels can be read from or written to sensitive files. Manipulating these attributes on binaries or configuration files leads directly to privilege escalation.

Root Cause

The root cause is unsafe symbolic link handling [CWE-59] during recursive directory traversal in libattr and the associated command-line utilities. The tools did not consistently use O_NOFOLLOW, openat with AT_SYMLINK_NOFOLLOW, or file descriptor-based traversal to guarantee that each opened path component is the same entity discovered during enumeration.

Attack Vector

Exploitation requires local access with low privileges and no user interaction. The attacker prepares a directory tree they control, waits for or induces a privileged process to invoke getfattr or setfattr recursively over that tree, then races to replace a path component with a symbolic link. Common triggers include backup scripts, ACL restoration jobs, and system provisioning tooling running as root. Refer to the VulnCheck Advisory on Attr Symlink Traversal for exploitation details.

Detection Methods for CVE-2026-54371

Indicators of Compromise

Unexpected modifications to extended attributes on SUID or SGID binaries, including security.capability values granting elevated capabilities.
Symbolic links appearing in world-writable or user-owned directories that resolve to sensitive paths such as /etc, /root, or /usr/bin.
Privileged invocations of getfattr -R or setfattr -R targeting paths under /tmp, /var/tmp, or user home directories.

Detection Strategies

Audit process execution logs for getfattr and setfattr invocations running as root with the recursive -R flag over non-system paths.
Monitor filesystem events for symlink and symlinkat syscalls in directories subsequently accessed by privileged attr utility processes.
Query the installed attr package version across the fleet and flag hosts running versions earlier than 2.6.0.

Monitoring Recommendations

Enable Linux Audit rules on setxattr, lsetxattr, fsetxattr, getxattr, and symlinkat to correlate symlink creation with subsequent extended attribute operations.
Alert on capability changes to files outside package-managed paths, particularly when preceded by attr utility execution.
Track file integrity of binaries in /usr/bin, /usr/sbin, and /bin for unexpected extended attribute changes.

How to Mitigate CVE-2026-54371

Immediate Actions Required

Upgrade the attr package to version 2.6.0 or later using the distribution package manager on all affected Linux hosts.
Audit scheduled jobs, backup scripts, and configuration management tooling that invoke getfattr or setfattr recursively as root, and restrict them to trusted paths.
Review host filesystems for existing symbolic links planted in directories traversed by privileged extended attribute operations.

Patch Information

The fix is delivered in upstream attr 2.6.0 via commits 49f79e947270 and c440855d6b33. Distribution-specific packages are tracked in the Red Hat advisory for CVE-2026-54371 and Red Hat Bug Report #2490283.

Workarounds

Avoid running getfattr -R or setfattr -R as root over any path containing directories writable by unprivileged users.
Replace recursive invocations with find commands using -xdev and explicit file descriptor handling to constrain traversal.
Restrict local shell access on multi-user systems until the patched attr package is deployed.

bash

# Verify installed attr version and upgrade
rpm -q attr        # RHEL/Fedora
dpkg -l attr       # Debian/Ubuntu

# Upgrade to patched release
sudo dnf update attr
sudo apt-get update && sudo apt-get install --only-upgrade attr