The vulnerability CVE-2026-32282 affects the Go standard library's internal syscall interface on Linux platforms. Specifically, the Root.Chmod function uses the fchmodat syscall with the AT_SYMLINK_NOFOLLOW flag to avoid following symlinks. However, the Linux implementation silently ignores this flag, allowing a race condition where the target file can be replaced by a symlink after the initial check but before the chmod operation. This can cause Root.Chmod to modify the permissions of a file outside the intended root directory if the symlink points elsewhere. The impact is limited to this race condition window and requires the attacker to replace the target with a symlink during the operation. There is no CVSS score or official patch available at this time.

The impact is a potential unauthorized modification of file permissions outside the intended root directory due to symlink traversal during a chmod operation. This could lead to privilege escalation or unauthorized access if exploited. However, the vulnerability requires a precise race condition to be triggered, limiting its practical exploitability. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should be aware of the race condition risk when using Root.Chmod on Linux and consider additional application-level checks or avoid relying on this function in security-critical contexts.