The vulnerability CVE-2026-54369 affects the acl package's libacl pathname-based functions (acl_get_file(), acl_set_file(), acl_extended_file(), and acl_delete_def_file()) prior to version 2.4.0. It allows a local attacker with the ability to create symbolic links in directories processed by privileged programs to replace any pathname component with a symlink. This improper link resolution (CWE-59) enables redirection of ACL read or write operations to arbitrary files or directories, potentially allowing unauthorized modification of access control lists and local privilege escalation. Red Hat's advisory highlights that exploitation requires local access and the ability to create symlinks in directories used by privileged processes. Default file permissions and the fs.protected_symlinks sysctl reduce the attack surface in standard RHEL and OpenShift CoreOS configurations. Red Hat has issued security updates fixing this issue in acl version 2.4.0 for Red Hat Enterprise Linux 10 and related architectures. The advisory also references a related TOCTOU symlink traversal vulnerability (CVE-2026-54370).

A local attacker who can create symbolic links in directories processed by privileged programs using libacl functions can redirect ACL operations to arbitrary files or directories. This enables unauthorized reading or modification of access control lists, which can lead to local privilege escalation. The vulnerability impacts confidentiality and integrity with high impact, but does not affect availability. The attack requires local access with low complexity and no user interaction.

A fix is available in acl version 2.4.0, which should be applied to affected systems. Red Hat has released updated packages for Red Hat Enterprise Linux 10 and related variants. Where patching is not immediately possible, mitigate by restricting unprivileged users from creating symbolic links in directories accessed by privileged processes running ACL commands. Additionally, enable and ensure the fs.protected_symlinks sysctl is active (enabled by default on RHEL 7 and later), which prevents symlink following in world-writable sticky directories unless the symlink owner matches the target owner. These mitigations reduce the practical attack surface and risk of exploitation.