CVE-2026-5958 is a TOCTOU race condition vulnerability in GNU sed's handling of the --follow-symlinks option combined with the -i (in-place) flag. When sed resolves a symlink and then reopens the path for writing, an attacker with write permissions to the directory can swap the symlink between these operations. This can lead to arbitrary file overwrites and potential privilege escalation if a privileged process executes sed on an attacker-controlled path. The flaw specifically affects Red Hat Hardened Images RPMs including sed-4.10-1.hum1 for aarch64 and x86_64. Red Hat classifies this as a moderate severity issue with a CVSS 3.1 base score of 6.3 (AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H). The vulnerability is tracked as CWE-367 (TOCTOU race condition).

An attacker with write access to a directory containing a symlink can exploit this race condition to cause sed to overwrite arbitrary files when run with the -i and --follow-symlinks options by a privileged user. This can lead to arbitrary file overwrites and potential privilege escalation. The integrity and availability of the system can be impacted. Confidentiality is not affected.

Avoid using the 'sed -i --follow-symlinks' command in privileged contexts or on paths that can be influenced by untrusted users. Restricting the use of the --follow-symlinks option in sensitive operations reduces the risk of exploitation. Patch status is not yet confirmed—check the Red Hat advisory for updates on fixes. No other mitigation or official fix is currently provided.