Symlink Vulnerability in Linux Affecting Various Applications

CVE-2026-32282

What is CVE-2026-32282?

A vulnerability exists in the Root.Chmod operation on Linux systems, allowing for potential symlink traversal issues. If the target of a chmod operation is replaced with a symlink during the execution, the chmod can inadvertently operate on the symlink's target. This is due to the fchmodat system call bypassing the AT_SYMLINK_NOFOLLOW flag, which is intended to prevent unauthorized access to files outside the intended root directory. Although Root.Chmod verifies its target before execution and usually raises an error for unsafe symlinks, this race condition might allow unauthorized file modifications between the verification and operation stages.

References