The acl project before version 2.4.0 contains a TOCTOU race condition vulnerability. This occurs because the software performs an lstat() check on a pathname component and then follows symbolic links in subsequent operations such as stat(), chown(), chmod(), acl_get_file(), and acl_set_file(). An attacker who can replace a pathname component with a symbolic link in the time between these operations can redirect file ACL operations to arbitrary files. When privileged processes run getfacl, setfacl, or chacl on attacker-controlled paths, this can lead to local privilege escalation.

Local attackers with the ability to control pathname components can exploit this vulnerability to escalate privileges on the affected system. This is achieved by redirecting file ACL operations to arbitrary files, potentially compromising system security and integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid running getfacl, setfacl, or chacl on untrusted or attacker-controlled paths with elevated privileges to reduce risk.