On Linux, the Go standard library's Root.Chmod function attempts to avoid symlink traversal by checking if the target is a symlink outside the root and returning an error if so. However, due to the Linux fchmodat syscall ignoring the AT_SYMLINK_NOFOLLOW flag, if the target file is replaced with a symlink after the check but before the chmod operation, Root.Chmod may inadvertently operate on the symlink's target outside the intended root directory. This is a race condition vulnerability classified as CWE-61 (Improper Restriction of Symbolic Links). It affects Go versions up to 1.26.0-0. No official patch or remediation level has been published yet, and no known exploits are reported in the wild.

The vulnerability allows a local attacker with high privileges to potentially cause Root.Chmod to change permissions on files outside the intended root directory by exploiting a race condition involving symlink replacement. This could lead to unauthorized modification of file permissions, impacting confidentiality, integrity, and availability of affected files. However, exploitation requires precise timing and elevated privileges, limiting the practical impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should be cautious when using Root.Chmod in environments where untrusted users can replace files with symlinks during operations. Consider implementing additional application-level checks or avoiding use of vulnerable versions if possible.