This security update addresses two vulnerabilities in the `acl` utilities (`getfacl`/`setfacl`) and `libacl` functions on Red Hat Enterprise Linux 10, involving symlink traversal that can lead to privilege escalation (CVE-2026-54369, CVSS 7.1 HIGH) and a TOCTOU race condition (CVE-2026-54370, CVSS 6.3 MEDIUM). The advisory is rated Important and applies to all listed architectures of RHEL 10. Red Hat has released updated packages to remediate these issues; administrators should apply the update via the referenced Red Hat solution article.
Red Hat Product Errata RHSA-2026:42739 - Security Advisory Issued: 2026-07-21 Updated: 2026-07-21 RHSA-2026:42739 - Security Advisory Overview Updated Packages Synopsis Important: acl security update Type/Severity Security Advisory: Important Red Hat Lightspeed patch analysis Identify and remediate systems affected by this advisory. View affected systems Topic An update for acl is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description Access Control Lists (ACLs) are used to define fine-grained discretionary access rights for files and directories. The acl packages contain the getfacl and setfacl utilities needed for manipulating access control lists. Security Fix(es): acl: Symlink traversal privilege escalation via libacl functions (CVE-2026-54369) acl: TOCTOU Symlink Traversal via getfacl/setfacl (CVE-2026-54370) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Affected Products Red Hat Enterprise Linux for x86_64 10 x86_64 Red Hat Enterprise Linux for x86_64 - Extended Update Support 10.2 x86_64 Red Hat Enterprise Linux for IBM z Systems 10 s390x Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 10.2 s390x Red Hat Enterprise Linux for Power, little endian 10 ppc64le Red Hat Enterprise Linux for Power, little endian - Extended Update Support 10.2 ppc64le Red Hat Enterprise Linux for ARM 64 10 aarch64 Red Hat Enterprise Linux for ARM 64 - Extended Update Support 10.2 aarch64 Red Hat Enterprise Linux for ARM 64 - 4 years of updates 10.2 aarch64 Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 10.2 s390x Red Hat Enterprise Linux for Power, little endian - 4 years of support 10.2 ppc64le Red Hat Enterprise Linux for x86_64 - 4 years of updates 10.2 x86_64 Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 10.2 x86_64 Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 10.2 aarch64 Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 10.2 ppc64le Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 10.2 s390x Fixes BZ - 2490277 - CVE-2026-54369 acl: Symlink traversal privilege escalation via libacl functions BZ - 2490279 - CVE-2026-54370 acl: TOCTOU Symlink Traversal via getfacl/setfacl CVEs CVE-2026-54369 CVE-2026-54370 References https://access.redhat.com/security/updates/classification/#important Note: More recent versions of these packages may be available. Click a package name for more details. Red Hat Enterprise Linux for x86_64 10 SRPM acl-2.4.0-1.el10_2.src.rpm SHA-256: e5e92d8353097c24e626db1760d3b715a003ae6fd87066480c25a832190fea9f x86_64 acl-2.4.0-1.el10_2.x86_64.rpm SHA-256: 4c4edac775f94b1331e8c6a0c549306405d13508e7e9045d7155c43a8adb0569 acl-debuginfo-2.4.0-1.el10_2.x86_64.rpm SHA-256: d6ed98e2314c6d5ff37b156f1519ad0e8372d0d3643909b49fe1776c41cfcab1 acl-debuginfo-2.4.0-1.el10_2.x86_64.rpm SHA-256: d6ed98e2314c6d5ff37b156f1519ad0e8372d0d3643909b49fe1776c41cfcab1 acl-debugsource-2.4.0-1.el10_2.x86_64.rpm SHA-256: bbf8492c1b3cc380e99a66c5eeab4f93f93a4edde7df2f95d949c877826fc3d7 acl-debugsource-2.4.0-1.el10_2.x86_64.rpm SHA-256: bbf8492c1b3cc380e99a66c5eeab4f93f93a4edde7df2f95d949c877826fc3d7 libacl-2.4.0-1.el10_2.x86_64.rpm SHA-256: 192efc2255ae042f62cf40c78bd648e7712919865bbfcaa629420ae6e9ed4140 libacl-debuginfo-2.4.0-1.el10_2.x86_64.rpm SHA-256: ecbdfc45ff93ce6a9663a155197a79242fed3924b7eda240505c1bf99646f690 libacl-debuginfo-2.4.0-1.el10_2.x86_64.rpm SHA-256: ecbdfc45ff93ce6a9663a155197a79242fed3924b7eda240505c1bf99646f690 libacl-devel-2.4.0-1.el10_2.x86_64.rpm SHA-256: 347556b4efc2afa0ed49a170402294a2d61eca6f9a9b57624ba432c7d068f45b Red Hat Enterprise Linux for x86_64 - Extended Update Support 10.2 SRPM acl-2.4.0-1.el10_2.src.rpm SHA-256: e5e92d8353097c24e626db1760d3b715a003ae6fd87066480c25a832190fea9f x86_64 acl-2.4.0-1.el10_2.x86_64.rpm SHA-256: 4c4edac775f94b1331e8c6a0c549306405d13508e7e9045d7155c43a8adb0569 acl-debuginfo-2.4.0-1.el10_2.x86_64.rpm SHA-256: d6ed98e2314c6d5ff37b156f1519ad0e8372d0d3643909b49fe1776c41cfcab1 acl-debuginfo-2.4.0-1.el10_2.x86_64.rpm SHA-256: d6ed98e2314c6d5ff37b156f1519ad0e8372d0d3643909b49fe1776c41cfcab1 acl-debugsource-2.4.0-1.el10_2.x86_64.rpm SHA-256: bbf8492c1b3cc380e99a66c5eeab4f93f93a4edde7df2f95d949c877826fc3d7 acl-debugsource-2.4.0-1.el10_2.x86_64.rpm SHA-256: bbf8492c1b3cc380e99a66c5eeab4f93f93a4edde7df2f95d949c877826fc3d7 libacl-2.4.0-1.el10_2.x86_64.rpm SHA-256: 192efc2255ae042f62cf40c78bd648e7712919865bbfcaa629420ae6e9ed4140 libacl-debuginfo-2.4.0-1.el10_2.x86_64.rpm SHA-256: ecbdfc45ff93ce6a9663a155197a79242fed3924b7eda240505c1bf99646f690 libacl-debuginfo-2.4.0-1.el10_2.x86_64.rpm SHA-256: ecbdfc45ff93ce6a9663a155197a79242fed3924b7eda240505c1bf99646f690 libacl-devel-2.4.0-1.el10_2.x86_64.rpm SHA-256: 347556b4efc2afa0ed49a170402294a2d61eca6f9a9b57624ba432c7d068f45b Red Hat Enterprise Linux for IBM z Systems 10 SRPM acl-2.4.0-1.el10_2.src.rpm SHA-256: e5e92d8353097c24e626db1760d3b715a003ae6fd87066480c25a832190fea9f s390x acl-2.4.0-1.el10_2.s390x.rpm SHA-256: d3736600850b476121dc2124784f1457fa457c5da7358d81786b59f41b3b23bd acl-debuginfo-2.4.0-1.el10_2.s390x.rpm SHA-256: abdedb14a0e243bbee38716a6df09400155934bdac47ecd41ae5e954a14b0f64 acl-debuginfo-2.4.0-1.el10_2.s390x.rpm SHA-256: abdedb14a0e243bbee38716a6df09400155934bdac47ecd41ae5e954a14b0f64 acl-debugsource-2.4.0-1.el10_2.s390x.rpm SHA-256: 1b5047eb4d2083b796f31df981560c2c1b53ed5c1dc3b2628d1af17ab00e6c62 acl-debugsource-2.4.0-1.el10_2.s390x.rpm SHA-256: 1b5047eb4d2083b796f31df981560c2c1b53ed5c1dc3b2628d1af17ab00e6c62 libacl-2.4.0-1.el10_2.s390x.rpm SHA-256: b86afde797f63376b976230298729b0370ad65c23a5e07d9ff683589d6d96bae libacl-debuginfo-2.4.0-1.el10_2.s390x.rpm SHA-256: 8b60d220a9ebc4644e535450664609eac12d576b2afa4ec06bc7ea8ec5109636 libacl-debuginfo-2.4.0-1.el10_2.s390x.rpm SHA-256: 8b60d220a9ebc4644e535450664609eac12d576b2afa4ec06bc7ea8ec5109636 libacl-devel-2.4.0-1.el10_2.s390x.rpm SHA-256: 64b44aff49f69ebd34097032c859aceb4e6eece20589fb7314f7450cdeee9150 Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 10.2 SRPM acl-2.4.0-1.el10_2.src.rpm SHA-256: e5e92d8353097c24e626db1760d3b715a003ae6fd87066480c25a832190fea9f s390x acl-2.4.0-1.el10_2.s390x.rpm SHA-256: d3736600850b476121dc2124784f1457fa457c5da7358d81786b59f41b3b23bd acl-debuginfo-2.4.0-1.el10_2.s390x.rpm SHA-256: abdedb14a0e243bbee38716a6df09400155934bdac47ecd41ae5e954a14b0f64 acl-debuginfo-2.4.0-1.el10_2.s390x.rpm SHA-256: abdedb14a0e243bbee38716a6df09400155934bdac47ecd41ae5e954a14b0f64 acl-debugsource-2.4.0-1.el10_2.s390x.rpm SHA-256: 1b5047eb4d2083b796f31df981560c2c1b53ed5c1dc3b2628d1af17ab00e6c62 acl-debugsource-2.4.0-1.el10_2.s390x.rpm SHA-256: 1b5047eb4d2083b796f31df981560c2c1b53ed5c1dc3b2628d1af17ab00e6c62 libacl-2.4.0-1.el10_2.s390x.rpm SHA-256: b86afde797f63376b976230298729b0370ad65c23a5e07d9ff683589d6d96bae libacl-debuginfo-2.4.0-1.el10_2.s390x.rpm SHA-256: 8b60d220a9ebc4644e535450664609eac12d576b2afa4ec06bc7ea8ec5109636 libacl-debuginfo-2.4.0-1.el10_2.s390x.rpm SHA-256: 8b60d220a9ebc4644e535450664609eac12d576b2afa4ec06bc7ea8ec5109636 libacl-devel-2.4.0-1.el10_2.s390x.rpm SHA-256: 64b44aff49f69ebd34097032c859aceb4e6eece20589fb7314f7450cdeee9150 Red Hat Enterprise Linux for Power, little endian 10 SRPM acl-2.4.0-1.el10_2.src.rpm SHA-256: e5e92d8353097c24e626db1760d3b715a003ae6fd87066480c25a832190fea9f ppc64le acl-2.4.0-1.el10_2.ppc64le.rpm SHA-256: 883ecc6ef63c24b35fe70ca5b5ca2fa7175c7c488d36955d605b0afed7440e22 acl-debuginfo-2.4.0-1.el10_2.ppc64le.rpm SHA-256: 376d3572b9c417d1d97f528f12471bb060a8aaa35ef16278779710b7c362ea62 acl-debuginfo-2.4.0-1.el10_2.ppc64le.rpm SHA-256: 376d3572b9c417d1d97f528f12471bb060a8aaa35ef16278779710b7c362ea62 acl-debugsource-2.4.0-1.el10_2.ppc64le.rpm SHA-256: 35e4f2288ffab3d8362e4571594fe4dad7665d85894d9c332d7fa3b96de36856 acl-debugsource-2.4.0-1.el10_2.ppc64le.rpm SHA-256: 35e4f2288ffab3d8362e4571594fe4dad7665d85894d9c332d7fa3b96de36856 libacl-2.4.0-1.el10_2.ppc64le.rpm SHA-256: aa7fcece0454fe0265c45c6bd806761b75fa1ae26a2a61085faca4e7a1413d74 libacl-debuginfo-2.4.0-1.el10_2.ppc64le.rpm SHA-256: 327bca32042c19f5184a2841921d277b0ddbf6d0f1cc87ef31edebc1febd7a87 libacl-debuginfo-2.4.0-1.el10_2.ppc64le.rpm SHA-256: 327bca32042c19f5184a2841921d277b0ddbf6d0f1cc87ef31edebc1febd7a87 libacl-devel-2.4.0-1.el10_2.ppc64le.rpm SHA-256: 00c892e0bd2c49a09799b4c18cb75ffb010209980724a82b155ee5a746421328 Red Hat Enterprise Linux for Power, little endian - Extended Update Support 10.2 SRPM acl-2.4.0-1.el10_2.src.rpm SHA-256: e5e92d8353097c24e626db1760d3b715a003ae6fd87066480c25a832190fea9f ppc64le acl-2.4.0-1.el10_2.ppc64le.rpm SHA-256: 883ecc6ef63c24b35fe70ca5b5ca2fa7175c7c488d36955d605b0afed7440e22 acl-debuginfo-2.4.0-1.el10_2.ppc64le.rpm SHA-256: 376d3572b9c417d1d97f528f12471bb060a8aaa35ef16278779710b7c362ea62 acl-debuginfo-2.4.0-1.el10_2.ppc64le.rpm SHA-256: 376d3572b9c417d1d97f528f12471bb060a8aaa35ef16278779710b7c362ea62 acl-debugsource-2.4.0-1.el10_2.ppc64le.rpm SHA-256: 35e4f2288ffab3d8362e4571594fe4dad7665d85894d9c332d7fa3b96de36856 acl-debugsource-2.4.0-1.el10_2.ppc64le.rpm SHA-256: 35e4f2288ffab3d8362e4571594fe4dad7665d85894d9c332d7fa3b96de36856 libacl-2.4.0-1.el10_2.ppc64le.rpm SHA-256: aa7fcece0454fe0265c45c6bd806761b75fa1ae26a2a61085faca4e7a1413d74 libacl-debuginfo-2.4.0-1.el10_2.ppc64le.rpm SHA-256: 327bca32042c19f5184a2841921d277b0ddbf6d0f1cc87ef31edebc1febd7a87 libacl-debuginfo-2.4.0-1.el10_2.ppc64le.rpm SHA-256: 327bca32042c19f5184a2841921d277b0ddbf6d0f1cc87ef