CVE-2026-16552 is a vulnerability in systemd-tmpfiles where processing a tmpfiles.d configuration entry that writes to a file can follow a symbolic link placed by an unprivileged local user. The existing safety check fails to detect this case because it assumes transitions away from the root user are safe. On systems where tmpfiles.d targets paths influenced by unprivileged users, this can allow redirection of privileged writes to attacker-controlled files, impacting integrity. The vulnerability does not allow control over the content written, only the destination file. No patch information is provided in the advisory.

An unprivileged local user can cause systemd-tmpfiles to write privileged data to arbitrary files by exploiting symbolic link handling. This can lead to unauthorized modification of files, affecting system integrity and availability. Confidentiality is not impacted. The vulnerability requires local access and high attack complexity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is provided in the available advisory content. Until a patch is available, restrict unprivileged user ability to influence paths targeted by tmpfiles.d configurations to mitigate risk.