TOCTOU Race Condition Vulnerability in acl by GNU

CVE-2026-54370

What is CVE-2026-54370?

The acl library prior to version 2.4.0 is susceptible to a race condition vulnerability, specifically a time-of-check to time-of-use (TOCTOU) race condition. This flaw enables local attackers to escalate their privileges by manipulating a pathname component with a symbolic link. By conducting a lstat() check followed by symlink-following operations like stat(), chown(), and chmod(), attackers can redirect file access control list operations to arbitrary files. Consequently, this can lead to unauthorized access to privileged processes that utilize functions like getfacl, setfacl, or chacl over an attacker-controlled path.

References