Red Hat Product Errata RHSA-2026:42736 - Security Advisory Issued: 2026-07-21 Updated: 2026-07-21 RHSA-2026:42736 - Security Advisory Overview Updated Packages Synopsis Important: acl security update Type/Severity Security Advisory: Important Red Hat Lightspeed patch analysis Identify and remediate systems affected by this advisory. View affected systems Topic An update for acl is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description Access Control Lists (ACLs) are used to define fine-grained discretionary access rights for files and directories. The acl packages contain the getfacl and setfacl utilities needed for manipulating access control lists. Security Fix(es): acl: Symlink traversal privilege escalation via libacl functions (CVE-2026-54369) acl: TOCTOU Symlink Traversal via getfacl/setfacl (CVE-2026-54370) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Affected Products Red Hat Enterprise Linux for x86_64 9 x86_64 Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.8 x86_64 Red Hat Enterprise Linux for IBM z Systems 9 s390x Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 9.8 s390x Red Hat Enterprise Linux for Power, little endian 9 ppc64le Red Hat Enterprise Linux for Power, little endian - Extended Update Support 9.8 ppc64le Red Hat Enterprise Linux for ARM 64 9 aarch64 Red Hat Enterprise Linux for ARM 64 - Extended Update Support 9.8 aarch64 Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.8 ppc64le Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.8 x86_64 Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.8 aarch64 Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.8 s390x Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 9.8 x86_64 Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 9.8 aarch64 Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 9.8 ppc64le Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 9.8 s390x Fixes BZ - 2490277 - CVE-2026-54369 acl: Symlink traversal privilege escalation via libacl functions BZ - 2490279 - CVE-2026-54370 acl: TOCTOU Symlink Traversal via getfacl/setfacl CVEs CVE-2026-54369 CVE-2026-54370 References https://access.redhat.com/security/updates/classification/#important Note: More recent versions of these packages may be available. Click a package name for more details. Red Hat Enterprise Linux for x86_64 9 SRPM acl-2.4.0-1.el9_8.src.rpm SHA-256: b140deb68f46517b0093e18969d8fb42a17216064fb2ee5783e9316d786430db x86_64 acl-2.4.0-1.el9_8.x86_64.rpm SHA-256: 611da2c85401a2f26dba165c0be27b2e62fa71ceb5c392c8f5a9d30c31238d5b acl-debuginfo-2.4.0-1.el9_8.i686.rpm SHA-256: 3906e65e9bf85ca537f0a5be54f151227a7017c125a2832f62fd78ff82d14314 acl-debuginfo-2.4.0-1.el9_8.i686.rpm SHA-256: 3906e65e9bf85ca537f0a5be54f151227a7017c125a2832f62fd78ff82d14314 acl-debuginfo-2.4.0-1.el9_8.x86_64.rpm SHA-256: c6941727a6c73f94f9b2de1ac7b841676c666dc8997c5c7f00785d4d3110991c acl-debuginfo-2.4.0-1.el9_8.x86_64.rpm SHA-256: c6941727a6c73f94f9b2de1ac7b841676c666dc8997c5c7f00785d4d3110991c acl-debugsource-2.4.0-1.el9_8.i686.rpm SHA-256: ccbff7836a7a78c314cd4bbeaee064f2c0bca025cef2f4aaaeafc1fce56e3588 acl-debugsource-2.4.0-1.el9_8.i686.rpm SHA-256: ccbff7836a7a78c314cd4bbeaee064f2c0bca025cef2f4aaaeafc1fce56e3588 acl-debugsource-2.4.0-1.el9_8.x86_64.rpm SHA-256: 80fc64ff557c38ae217e157047f0876848af972ae4c71742ffcf33c352f84953 acl-debugsource-2.4.0-1.el9_8.x86_64.rpm SHA-256: 80fc64ff557c38ae217e157047f0876848af972ae4c71742ffcf33c352f84953 libacl-2.4.0-1.el9_8.i686.rpm SHA-256: 5ff0363f187740a0b3f8f2ec1310d6ea48a8e5dcc184d94366827d17de3cdb3e libacl-2.4.0-1.el9_8.x86_64.rpm SHA-256: a81fb7a4d7c946e9bd886ee3c471a4b5040dedbb8ffb2a388120b2094be93cc8 libacl-debuginfo-2.4.0-1.el9_8.i686.rpm SHA-256: 4e95c2f63b77ca55dc4147a639c535185dba2214588c9cf1b60e1be668c5c84b libacl-debuginfo-2.4.0-1.el9_8.i686.rpm SHA-256: 4e95c2f63b77ca55dc4147a639c535185dba2214588c9cf1b60e1be668c5c84b libacl-debuginfo-2.4.0-1.el9_8.x86_64.rpm SHA-256: d7b70eeffdbe16015bc2ac2aa8f8a2efd126c3d218efea4928f82687ef3013ec libacl-debuginfo-2.4.0-1.el9_8.x86_64.rpm SHA-256: d7b70eeffdbe16015bc2ac2aa8f8a2efd126c3d218efea4928f82687ef3013ec libacl-devel-2.4.0-1.el9_8.i686.rpm SHA-256: e98342f6e5f806fff6d83f95d4a5ca5467f94b17873c11f292f8f8d95d79f16c libacl-devel-2.4.0-1.el9_8.x86_64.rpm SHA-256: 723580115b9d71bd765bb63129dd186af2666419fb846ed47ae1850b29a1c84b Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.8 SRPM acl-2.4.0-1.el9_8.src.rpm SHA-256: b140deb68f46517b0093e18969d8fb42a17216064fb2ee5783e9316d786430db x86_64 acl-2.4.0-1.el9_8.x86_64.rpm SHA-256: 611da2c85401a2f26dba165c0be27b2e62fa71ceb5c392c8f5a9d30c31238d5b acl-debuginfo-2.4.0-1.el9_8.i686.rpm SHA-256: 3906e65e9bf85ca537f0a5be54f151227a7017c125a2832f62fd78ff82d14314 acl-debuginfo-2.4.0-1.el9_8.i686.rpm SHA-256: 3906e65e9bf85ca537f0a5be54f151227a7017c125a2832f62fd78ff82d14314 acl-debuginfo-2.4.0-1.el9_8.x86_64.rpm SHA-256: c6941727a6c73f94f9b2de1ac7b841676c666dc8997c5c7f00785d4d3110991c acl-debuginfo-2.4.0-1.el9_8.x86_64.rpm SHA-256: c6941727a6c73f94f9b2de1ac7b841676c666dc8997c5c7f00785d4d3110991c acl-debugsource-2.4.0-1.el9_8.i686.rpm SHA-256: ccbff7836a7a78c314cd4bbeaee064f2c0bca025cef2f4aaaeafc1fce56e3588 acl-debugsource-2.4.0-1.el9_8.i686.rpm SHA-256: ccbff7836a7a78c314cd4bbeaee064f2c0bca025cef2f4aaaeafc1fce56e3588 acl-debugsource-2.4.0-1.el9_8.x86_64.rpm SHA-256: 80fc64ff557c38ae217e157047f0876848af972ae4c71742ffcf33c352f84953 acl-debugsource-2.4.0-1.el9_8.x86_64.rpm SHA-256: 80fc64ff557c38ae217e157047f0876848af972ae4c71742ffcf33c352f84953 libacl-2.4.0-1.el9_8.i686.rpm SHA-256: 5ff0363f187740a0b3f8f2ec1310d6ea48a8e5dcc184d94366827d17de3cdb3e libacl-2.4.0-1.el9_8.x86_64.rpm SHA-256: a81fb7a4d7c946e9bd886ee3c471a4b5040dedbb8ffb2a388120b2094be93cc8 libacl-debuginfo-2.4.0-1.el9_8.i686.rpm SHA-256: 4e95c2f63b77ca55dc4147a639c535185dba2214588c9cf1b60e1be668c5c84b libacl-debuginfo-2.4.0-1.el9_8.i686.rpm SHA-256: 4e95c2f63b77ca55dc4147a639c535185dba2214588c9cf1b60e1be668c5c84b libacl-debuginfo-2.4.0-1.el9_8.x86_64.rpm SHA-256: d7b70eeffdbe16015bc2ac2aa8f8a2efd126c3d218efea4928f82687ef3013ec libacl-debuginfo-2.4.0-1.el9_8.x86_64.rpm SHA-256: d7b70eeffdbe16015bc2ac2aa8f8a2efd126c3d218efea4928f82687ef3013ec libacl-devel-2.4.0-1.el9_8.i686.rpm SHA-256: e98342f6e5f806fff6d83f95d4a5ca5467f94b17873c11f292f8f8d95d79f16c libacl-devel-2.4.0-1.el9_8.x86_64.rpm SHA-256: 723580115b9d71bd765bb63129dd186af2666419fb846ed47ae1850b29a1c84b Red Hat Enterprise Linux for IBM z Systems 9 SRPM acl-2.4.0-1.el9_8.src.rpm SHA-256: b140deb68f46517b0093e18969d8fb42a17216064fb2ee5783e9316d786430db s390x acl-2.4.0-1.el9_8.s390x.rpm SHA-256: 56703b3f1ea101d511db213be4e5bc5e60d640c9b5d2e815d883386fd1ed2f76 acl-debuginfo-2.4.0-1.el9_8.s390x.rpm SHA-256: c136c1472b25458180b3bde6dbc3e42686164e877163932933404267b5eebf57 acl-debuginfo-2.4.0-1.el9_8.s390x.rpm SHA-256: c136c1472b25458180b3bde6dbc3e42686164e877163932933404267b5eebf57 acl-debugsource-2.4.0-1.el9_8.s390x.rpm SHA-256: bf7e30e85b3dad837d5718c854b91921c99179b3c41f23c1e972ff1bd12012c2 acl-debugsource-2.4.0-1.el9_8.s390x.rpm SHA-256: bf7e30e85b3dad837d5718c854b91921c99179b3c41f23c1e972ff1bd12012c2 libacl-2.4.0-1.el9_8.s390x.rpm SHA-256: 716c3f6af6da1f3395061722cdaa43ba4329b6b7114ffaf0157e697403a5d7fd libacl-debuginfo-2.4.0-1.el9_8.s390x.rpm SHA-256: 1812faafaabc9a0f16de73889cd8c72dc9066169058db5ca3fa63b0bf45961e6 libacl-debuginfo-2.4.0-1.el9_8.s390x.rpm SHA-256: 1812faafaabc9a0f16de73889cd8c72dc9066169058db5ca3fa63b0bf45961e6 libacl-devel-2.4.0-1.el9_8.s390x.rpm SHA-256: a1e64802cfe5d1171ae8ada7a74875178ab58a79c5d48b3f6beff002d4493e42 Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 9.8 SRPM acl-2.4.0-1.el9_8.src.rpm SHA-256: b140deb68f46517b0093e18969d8fb42a17216064fb2ee5783e9316d786430db s390x acl-2.4.0-1.el9_8.s390x.rpm SHA-256: 56703b3f1ea101d511db213be4e5bc5e60d640c9b5d2e815d883386fd1ed2f76 acl-debuginfo-2.4.0-1.el9_8.s390x.rpm SHA-256: c136c1472b25458180b3bde6dbc3e42686164e877163932933404267b5eebf57 acl-debuginfo-2.4.0-1.el9_8.s390x.rpm SHA-256: c136c1472b25458180b3bde6dbc3e42686164e877163932933404267b5eebf57 acl-debugsource-2.4.0-1.el9_8.s390x.rpm SHA-256: bf7e30e85b3dad837d5718c854b91921c99179b3c41f23c1e972ff1bd12012c2 acl-debugsource-2.4.0-1.el9_8.s390x.rpm SHA-256: bf7e30e85b3dad837d5718c854b91921c99179b3c41f23c1e972ff1bd12012c2 libacl-2.4.0-1.el9_8.s390x.rpm SHA-256: 716c3f6af6da1f3395061722cdaa43ba4329b6b7114ffaf0157e697403a5d7fd libacl-debuginfo-2.4.0-1.el9_8.s390x.rpm SHA-256: 1812faafaabc9a0f16de73889cd8c72dc9066169058db5ca3fa63b0bf45961e6 libacl-debuginfo-2.4.0-1.el9_8.s390x.rpm SHA-256: 1812faafaabc9a0f16de73889cd8c72dc9066169058db5ca3fa63b0bf45961e6 libacl-devel-2.4.0-1.el9_8.s390x.rpm SHA-256: a1e64802cfe5d1171ae8ada7a74875178ab58a79c5d48b3f6beff002d4493e42 Red Hat Enterprise Linux for Power, little endian 9 SRPM acl-2.4.0-1.el9_8.src.rpm SHA-256: b140deb68f46517b0093e18969d8fb42a17216064fb2ee5783e9316d786430db ppc64le acl-2.4.0-1.el9_8.ppc64le.rpm SHA-256: e8d68d043a1bc11407edf1ed9f482631bbd26720698617ec994208c9c0a056a5 acl-debuginfo-2.4.0-1.el9_8.ppc64le.rpm SHA-256: 9dc840538fd6f279af24cb2b18a3546bdb12dbc3fc3753c3f84f6786174eeeaa acl-debuginfo-2.4.0-1.el9_8.ppc64le.rpm SHA-256: 9dc840538fd6f279af24cb2b18a3546bdb12dbc3fc3753c3f84f6786174eeeaa acl-debugsource-2.4.0-1.el9_8.ppc64le.rpm SH