The vulnerability CVE-2026-16552 affects systemd-tmpfiles in Red Hat Enterprise Linux 10. When processing tmpfiles.d configuration entries that write to files, systemd-tmpfiles can follow symbolic links created by unprivileged users. The existing safety check fails to detect this because it assumes transitions away from root are safe, allowing an unprivileged user to redirect privileged writes to arbitrary files. Although the content written is controlled by the configuration and not the attacker, this improper link resolution can compromise system integrity by overwriting files unexpectedly.

An unprivileged local user can cause systemd-tmpfiles to write to arbitrary files by exploiting symbolic link following, potentially overwriting critical files and compromising system integrity. The vulnerability does not allow direct control over the content written but can redirect privileged writes to attacker-influenced paths. There is no indication of confidentiality or availability impact beyond the integrity risk. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-16552 for current remediation guidance. Until an official fix is available, restrict unprivileged users' ability to influence paths targeted by tmpfiles.d configurations. Review and harden tmpfiles.d configurations to avoid referencing paths writable or controllable by unprivileged users.