Critical Security Update for libacl: ACL Vulnerability in Red Hat Enterprise Linux
Summary
RHSA-2026:42739: Red Hat Security Advisory: acl security update. Affects libacl-debuginfo versions < 0:2.4.0-1.el10_2. Fixed in 0:2.4.0-1.el10_2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The libacl package is a part of the Red Hat Enterprise Linux ecosystem, providing support for Access Control Lists (ACLs) which allow for more granular permissions on files and directories. This package is essential for managing user permissions beyond the traditional Unix file permissions. The recent vulnerability affects multiple components of the libacl package, including libacl-debuginfo, libacl-devel, acl, and libacl itself, making it crucial for users to address this issue promptly.
Vulnerability Detail
The vulnerability, identified as CVE-2026-54369 and CVE-2026-54370, originates from flaws in the ACL implementation that could allow unauthorized access to sensitive data. This could lead to data breaches or unauthorized modifications, posing significant risks to system integrity and confidentiality. The CVSS score of this vulnerability is 7.1, indicating a high severity level that necessitates immediate attention.
How To Fix
Minimum fixed version
0:2.4.0-1.el10_2
This is the first release that contains the fix.
sudo dnf update libacl-debuginfoTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can restrict access to sensitive files and directories by modifying permissions manually until the update is applied. This can be done using the command: 'chmod 700 /path/to/sensitive/file' to limit access to the owner only.
Conclusion
The identified vulnerabilities in the libacl package pose significant risks to system security. It is imperative for users to update their packages to the patched version to mitigate these risks. Utilizing tools like Vulert can help in monitoring vulnerabilities effectively.
See every vulnerability recorded for libacl-debuginfo →
FAQ
The vulnerability affects the ACL implementation in libacl, potentially allowing unauthorized access to sensitive data.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected.
The CVSS score of this vulnerability is 7.1, indicating a high severity level.
If immediate updates are not possible, consider applying stricter file permissions as a temporary workaround.
More information can be found in the Red Hat Security Advisory RHSA-2026:42739.
Related vulnerabilities
Recent vulnerabilities recorded for libacl-debuginfo.
