CVE-2026-54371 is a vulnerability in the attr package where the getfattr and setfattr utilities improperly resolve symbolic links during pathname traversal or backup restoration. When these utilities are run by privileged processes on paths controlled by an attacker, the attacker can replace pathname components with symbolic links to arbitrary files, enabling local privilege escalation. The vulnerability is classified under CWE-59 (Improper Link Resolution Before File Access). Red Hat has assigned a CVSS v3 base score of 6.3 (medium severity) reflecting local attack vector, high confidentiality and integrity impact, and low privileges required. The flaw affects Red Hat Hardened Images RPMs including attr-2.6.0-9.1.hum1 and related packages for aarch64 and x86_64 architectures. Currently, no official patch or mitigation meeting Red Hat's standards is available.

This vulnerability allows a local attacker to escalate privileges by exploiting symbolic link traversal in privileged utilities getfattr and setfattr. The attacker can cause these utilities to operate on arbitrary files by controlling path components, potentially reading or modifying sensitive files and bypassing security protections. The impact includes confidentiality and integrity compromise but does not affect availability. Exploitation requires local access and invocation of these utilities by privileged processes on attacker-controlled paths.

As of the advisory date, no official fix or mitigation meeting Red Hat's criteria for ease of use, applicability, and stability is available. Users should monitor Red Hat advisories for updates. Until a fix is released, avoid running getfattr or setfattr as privileged processes on untrusted or attacker-controlled paths. Consider restricting local access to these utilities and limiting privileged execution contexts where possible.