Critical ACL Security Vulnerability in AlmaLinux Packages: Elevation of Privileges
Summary
ALSA-2026:42739: Important: acl security update. Affects acl versions < 2.4.0-1.el10_2. Fixed in 2.4.0-1.el10_2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The acl package in AlmaLinux provides utilities such as getfacl and setfacl, which are essential for managing Access Control Lists (ACLs) that define fine-grained discretionary access rights for files and directories. This functionality is crucial for maintaining security and proper access management in a multi-user environment. However, vulnerabilities in these utilities can lead to significant security risks, including unauthorized access and privilege escalation.
Vulnerability Detail
The vulnerabilities identified as CVE-2026-54369 and CVE-2026-54370 relate to symlink traversal issues in the acl package. The first vulnerability allows for privilege escalation via libacl functions, while the second involves a Time-of-Check to Time-of-Use (TOCTOU) issue with getfacl and setfacl commands. These vulnerabilities can be exploited by an attacker to gain unauthorized access to sensitive files or execute arbitrary commands with elevated privileges, posing a severe risk to system integrity and data security.
How To Fix
Minimum fixed version
2.4.0-1.el10_2
This is the first release that contains the fix.
sudo dnf update aclTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can restrict access to the affected utilities by modifying file permissions or using alternative methods for managing access control until the packages can be updated. However, this is not a permanent solution and should be followed by an update as soon as possible.
Conclusion
The identified vulnerabilities in the acl package pose significant risks to system security due to potential privilege escalation and unauthorized access. It is crucial for users of AlmaLinux to update their packages to the latest patched versions to safeguard their systems. Regular monitoring and vulnerability management practices, such as utilizing tools like Vulert, can help maintain security in open-source software environments.
See every vulnerability recorded for acl →
FAQ
ACLs are a set of rules that define permissions for users and groups on files and directories, allowing for more granular control over access rights.
A symlink traversal attack occurs when an attacker exploits symbolic links to gain unauthorized access to files or directories outside of their intended scope.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If immediate updates are not possible, consider implementing temporary workarounds such as restricting access to the affected utilities until a proper update can be performed.
For detailed information about the vulnerabilities, including CVSS scores and acknowledgments, refer to the CVE pages linked in the advisory.
Related vulnerabilities
Recent vulnerabilities recorded for acl.
