This advisory from Red Hat Product Security addresses two security vulnerabilities (CVE-2026-54369 and CVE-2026-54370) in the acl package included in Red Hat Hardened Images RPMs. The affected RPMs are acl, libacl, and libacl-devel versions 2.4.0-0.1.hum1 for aarch64 and x86_64 architectures. The vulnerabilities correspond to CWE-59 and CWE-367, indicating issues related to symbolic link following and race conditions, respectively. The advisory provides updated RPMs as a security update but does not specify fixed version numbers or detailed patch information. No known exploits in the wild have been reported. The update is available via Red Hat's image repository.

The vulnerabilities affect the acl package in Red Hat Hardened Images RPMs and could potentially allow unauthorized actions related to file access control due to symbolic link and race condition weaknesses. The advisory classifies the severity as high but does not provide CVSS scores or detailed impact scenarios. No known exploitation in the wild has been reported at the time of this advisory.

Red Hat has released updated RPMs (acl-2.4.0-0.1.hum1 and related packages) as a security update to address these vulnerabilities. Users of Red Hat Hardened Images should apply these updates as provided by Red Hat. Since this is an official security advisory with updated packages available, applying the update is the recommended remediation. Patch status beyond the advisory is not explicitly detailed; users should consult the Red Hat advisory links for the latest update instructions and confirmation.