CVE-2026-86469: GLib2 Race Condition Vulnerability

CVE-2026-86469 Overview

A flaw exists in GLib2's g_file_replace() function when used with the G_FILE_CREATE_REPLACE_DESTINATION flag. When creation of the .goutputstream-XXXXXX temporary file fails, the library unlinks the destination and recreates it without exclusive creation semantics or symlink protection. A local attacker who can write to the destination directory can win the resulting race and redirect the write to another file. The issue is tracked as CWE-59: Improper Link Resolution Before File Access.

Critical Impact
A local attacker who wins the race window can redirect application writes to arbitrary files accessible to the invoking user, enabling integrity compromise of unrelated files.

Affected Products

GNOME GLib2 library (gio/glocalfileoutputstream.c)
Applications and desktop components that invoke g_file_replace() with G_FILE_CREATE_REPLACE_DESTINATION
Linux distributions shipping the affected GLib2 versions (see Red Hat advisory)

Discovery Timeline

2026-09-07 - CVE-2026-86469 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-86469

Vulnerability Analysis

The vulnerability resides in GLib2's local file output stream implementation in gio/glocalfileoutputstream.c. When an application calls g_file_replace() with the G_FILE_CREATE_REPLACE_DESTINATION flag, GLib attempts to create a temporary file named .goutputstream-XXXXXX in the target directory before atomically renaming it over the destination.

If temporary file creation fails, the fallback path unlinks the destination and recreates it. This recreation path does not use O_EXCL (exclusive creation) and does not use O_NOFOLLOW to reject symbolic links. An attacker with write access to the destination directory can substitute a symlink between the unlink() and the subsequent open() calls. Data intended for the original destination is then written through the symlink to an attacker-chosen path.

Root Cause

The root cause is a Time-of-Check to Time-of-Use (TOCTOU) race combined with unsafe file creation flags. The recreation step trusts the state of the filesystem after the failed temp-file operation and does not defensively refuse to follow symlinks or fail on pre-existing entries.

Attack Vector

Exploitation requires local access and write permission to the directory containing the destination file. The attacker must trigger or predict a failure of the .goutputstream-XXXXXX temporary file creation, then win the narrow race window to replace the destination path with a symlink pointing to a target file writable by the victim process. Successful exploitation permits unauthorized write to files outside the intended destination, impacting integrity of files owned by the invoking user. Refer to the Red Hat CVE-2026-86469 Advisory and GNOME Work Item #4044 for upstream technical discussion.

Detection Methods for CVE-2026-86469

Indicators of Compromise

Presence of unexpected symbolic links named after target files in user-writable directories used by applications calling g_file_replace().
Modification timestamps on sensitive files that correlate with GLib-based application writes to unrelated destinations.
Repeated failed open() or link() syscalls involving .goutputstream-* filenames in audit logs.

Detection Strategies

Audit filesystem syscalls (unlink, open, symlink, rename) targeting .goutputstream-* patterns using Linux audit rules or eBPF-based telemetry.
Alert on symlink creation in shared or world-writable directories that immediately precede writes by GLib-linked processes.
Correlate process ancestry with unexpected file modifications outside the process's normal working set.

Monitoring Recommendations

Enable auditd rules for symlink, symlinkat, and unlink operations in multi-user directories.
Collect and normalize file-system telemetry into a centralized data lake to enable retrospective hunts for .goutputstream-* race patterns.
Track integrity of sensitive user-owned configuration files with periodic hashing.

How to Mitigate CVE-2026-86469

Immediate Actions Required

Apply distribution-provided GLib2 updates once available. Track the Red Hat CVE-2026-86469 Advisory for package fix status.
Inventory applications linking against GLib2 that rely on g_file_replace() with G_FILE_CREATE_REPLACE_DESTINATION.
Restrict write access to shared directories used by GLib-based applications to reduce the attacker's ability to plant symlinks.

Patch Information

Upstream fix tracking is available at GNOME Work Item #4044 and the source is maintained at GNOME GLib Code Reference. Consult the Red Hat Bug Report #2473839 for downstream backports and package versions.

Workarounds

Avoid writing to directories where untrusted local users have write permission when using GLib-based applications.
Set the sticky bit (chmod +t) on shared directories to limit symlink swapping by non-owners.
Where feasible, run GLib-based applications under user namespaces or mount namespaces that isolate the destination directory from other local users.

bash

# Configuration example: harden shared directories used by GLib applications
chmod 1777 /path/to/shared-dir            # ensure sticky bit is set
sysctl -w fs.protected_symlinks=1         # restrict symlink following in world-writable dirs
sysctl -w fs.protected_hardlinks=1        # restrict hardlink creation similarly
# Persist across reboots
echo 'fs.protected_symlinks=1' >> /etc/sysctl.d/99-hardening.conf
echo 'fs.protected_hardlinks=1' >> /etc/sysctl.d/99-hardening.conf