CVE-2026-86469: Improper Link Resolution Before File Access ('Link Following') in Red Hat Red Hat Enterprise Linux 10

This vulnerability in GLib2 affects the g_file_replace() function when used with the G_FILE_CREATE_REPLACE_DESTINATION flag. If the creation of the temporary file (.goutputstream-XXXXXX) fails, the library unlinks the destination file and recreates it without exclusive creation or symlink protection, enabling a local attacker with write access to the destination directory to exploit a race condition. The attacker can redirect writes to arbitrary files that the victim process is allowed to write, potentially overwriting or creating files unexpectedly. The usual g_file_replace() path that writes to a temporary file first is not vulnerable; only the fallback path is affected. Exploitation requires local access, write permission to the directory, and winning a race condition. The vulnerability is tracked as CVE-2026-86469 and has a CVSS v3.1 score of 5.3 (medium severity).

A local attacker with write access to the destination directory can exploit a race condition to redirect file writes to arbitrary files that the victim process is permitted to write. This can lead to modification or creation of unintended files, potentially bypassing security mechanisms relying on file integrity. There is no confidentiality impact, but integrity impact is high and availability impact is low. Exploitation requires local access, write permission, and winning a race condition.

Red Hat advises not to use g_file_replace() with the G_FILE_CREATE_REPLACE_DESTINATION flag on paths within directories writable by less-privileged users. No official patch or fix is explicitly stated in the advisory at this time. Patch status is not yet confirmed — check the Red Hat advisory for current remediation guidance. Avoiding the vulnerable usage pattern is the recommended mitigation.