This security update addresses two vulnerabilities in the `acl` package for Red Hat Enterprise Linux 8: CVE-2026-54369 (CVSS 7.1 High) and CVE-2026-54370 (CVSS 6.3 Medium), which involve symlink traversal and TOCTOU race conditions in libacl functions and the `getfacl`/`setfacl` utilities, potentially allowing privilege escalation. The vulnerabilities affect Red Hat Enterprise Linux 8 systems, and the fix is provided in the updated `acl` package version 2.4.0-1.el8_10. Organizations should apply this update via the standard Red Hat channels.
Red Hat Product Errata RHSA-2026:43420 - Security Advisory Issued: 2026-07-22 Updated: 2026-07-22 RHSA-2026:43420 - Security Advisory Overview Updated Packages Synopsis Important: acl security update Type/Severity Security Advisory: Important Red Hat Lightspeed patch analysis Identify and remediate systems affected by this advisory. View affected systems Topic An update for acl is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description Access Control Lists (ACLs) are used to define fine-grained discretionary access rights for files and directories. The acl packages contain the getfacl and setfacl utilities needed for manipulating access control lists. Security Fix(es): acl: Symlink traversal privilege escalation via libacl functions (CVE-2026-54369) acl: TOCTOU Symlink Traversal via getfacl/setfacl (CVE-2026-54370) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Affected Products Red Hat Enterprise Linux for x86_64 8 x86_64 Red Hat Enterprise Linux for IBM z Systems 8 s390x Red Hat Enterprise Linux for Power, little endian 8 ppc64le Red Hat Enterprise Linux for ARM 64 8 aarch64 Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 8.10 x86_64 Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 8.10 aarch64 Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 8.10 ppc64le Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 8.10 s390x Fixes BZ - 2490277 - CVE-2026-54369 acl: Symlink traversal privilege escalation via libacl functions BZ - 2490279 - CVE-2026-54370 acl: TOCTOU Symlink Traversal via getfacl/setfacl CVEs CVE-2026-54369 CVE-2026-54370 References https://access.redhat.com/security/updates/classification/#important Note: More recent versions of these packages may be available. Click a package name for more details. Red Hat Enterprise Linux for x86_64 8 SRPM acl-2.4.0-1.el8_10.src.rpm SHA-256: d199a0f051d85a948e775c8e8222eff0de0733b7ca80f9a7a363aa1a5f0bbfbf x86_64 acl-2.4.0-1.el8_10.x86_64.rpm SHA-256: 46b6945a8813d2534247b99ce60eb3cbada796397c9986314908c9b76fe93954 acl-debuginfo-2.4.0-1.el8_10.i686.rpm SHA-256: 32b129538a9eb7605a91fc2e13d134acde8f9dafc479a908bf41a9552ee09456 acl-debuginfo-2.4.0-1.el8_10.x86_64.rpm SHA-256: 3614b0022e00dcb9a88683fe23839530f34f8bad5af7101549c15b5c0c37ff44 acl-debugsource-2.4.0-1.el8_10.i686.rpm SHA-256: d6a7ab75194a0b1ad625a30d26154264c4d12eaaa7346cf81139beae2eb2afb7 acl-debugsource-2.4.0-1.el8_10.x86_64.rpm SHA-256: 37923681fae34251cdadb4a7b4e203be6d26b5ebfef5a3e1b09c1143d7596ed5 libacl-2.4.0-1.el8_10.i686.rpm SHA-256: aeddc89aaea16c365729cf06b47e5984758e0f430a5f5b0cbdd8cd7ff7c9c451 libacl-2.4.0-1.el8_10.x86_64.rpm SHA-256: 17f2b882315c9eed038daf3420df6386f3c0fffd810309992fd244f4267edcf0 libacl-debuginfo-2.4.0-1.el8_10.i686.rpm SHA-256: 472e926a46de91200bd1d10fd89968101ec4f63c1c434963f267696b858849f4 libacl-debuginfo-2.4.0-1.el8_10.x86_64.rpm SHA-256: f956f377d483d6e641774844107d6a3fc3d629843e2ed0933b5d23a6940d621d libacl-devel-2.4.0-1.el8_10.i686.rpm SHA-256: 11a632192e0ef6004f7936df498821687e40288a3bef0daa28df0fc3214cc204 libacl-devel-2.4.0-1.el8_10.x86_64.rpm SHA-256: 5ec45b2da906047a47021f0cc1e62a0b8f7feddb50f7dd7df19c6ce0eb3c5471 Red Hat Enterprise Linux for IBM z Systems 8 SRPM acl-2.4.0-1.el8_10.src.rpm SHA-256: d199a0f051d85a948e775c8e8222eff0de0733b7ca80f9a7a363aa1a5f0bbfbf s390x acl-2.4.0-1.el8_10.s390x.rpm SHA-256: 069ee5ef36de435b520ece784f517d9692f441acb1cf06e02a090d63ceb714d5 acl-debuginfo-2.4.0-1.el8_10.s390x.rpm SHA-256: edd1f2f6a3bdfc208c8cd895d63f66d36869c8d6ba8428d7d4cf9f4523a5cd79 acl-debugsource-2.4.0-1.el8_10.s390x.rpm SHA-256: 4df37c8db5542fe69cf0dc89f1b75348b2562b61083b9f8422920ef9cf756199 libacl-2.4.0-1.el8_10.s390x.rpm SHA-256: b6cc5a98de9c5b20c4aa7efafff1f856abb572c7fed276ee6fab89d9ea08f406 libacl-debuginfo-2.4.0-1.el8_10.s390x.rpm SHA-256: 40e1dfdca8375cb25947b251d9af769a6ae52b044dc1f6b7e895432de1df5e01 libacl-devel-2.4.0-1.el8_10.s390x.rpm SHA-256: 74586d0b88292cb0fce10790427e5ed3fdb796052038717047204bae8fa85e17 Red Hat Enterprise Linux for Power, little endian 8 SRPM acl-2.4.0-1.el8_10.src.rpm SHA-256: d199a0f051d85a948e775c8e8222eff0de0733b7ca80f9a7a363aa1a5f0bbfbf ppc64le acl-2.4.0-1.el8_10.ppc64le.rpm SHA-256: 769bce69c9b1e1125ffa0332eac2f21931d7fcf8c6cfa80e5228c62007fe6709 acl-debuginfo-2.4.0-1.el8_10.ppc64le.rpm SHA-256: 37bf16e62d9f50a68c7553cca8feec25548bd239262f88ebde1e56360eab81ed acl-debugsource-2.4.0-1.el8_10.ppc64le.rpm SHA-256: 69214448aa5e6a18e24959b0dc6b1b47f0dfbff6ae100fc74f88558156d0182b libacl-2.4.0-1.el8_10.ppc64le.rpm SHA-256: 3236f00c540867779fdd032e1b75ec499759ee69bf30ff8bf7027f0d557892c8 libacl-debuginfo-2.4.0-1.el8_10.ppc64le.rpm SHA-256: 71feb7493c6ad0b74c5583acf76d66aeff2ed10de75fd5d4965f27b5940f5e5d libacl-devel-2.4.0-1.el8_10.ppc64le.rpm SHA-256: e61c309ff68d45d0cc62ddecee55b9205358eb6c12978ca80c5a84baa91bdc47 Red Hat Enterprise Linux for ARM 64 8 SRPM acl-2.4.0-1.el8_10.src.rpm SHA-256: d199a0f051d85a948e775c8e8222eff0de0733b7ca80f9a7a363aa1a5f0bbfbf aarch64 acl-2.4.0-1.el8_10.aarch64.rpm SHA-256: bf67fd777fc00af308a4ad2d4ae55dad8ac0f85520b854f7590c3ebcb8db34da acl-debuginfo-2.4.0-1.el8_10.aarch64.rpm SHA-256: f1baac5e29b262e3cc266d0fe45498cdead1b56f4a77ecb6637ee1058501a24c acl-debugsource-2.4.0-1.el8_10.aarch64.rpm SHA-256: 564a51c9d3db786f1c22001f5fc9a07c3be398b400d2b53cf8d305bc59666215 libacl-2.4.0-1.el8_10.aarch64.rpm SHA-256: 06b28cb70834c0b483ab8ef013565bd02480bbac3b9e4836c233e62b28aff564 libacl-debuginfo-2.4.0-1.el8_10.aarch64.rpm SHA-256: 20f139053fb18c3b0b31c11b77d225e772f7fff1792ab7988c3d809f88f725ea libacl-devel-2.4.0-1.el8_10.aarch64.rpm SHA-256: de0b82bafee5c82d9d66f854f672830b8ea318133445a016975229a09fd54128 Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 8.10 SRPM acl-2.4.0-1.el8_10.src.rpm SHA-256: d199a0f051d85a948e775c8e8222eff0de0733b7ca80f9a7a363aa1a5f0bbfbf x86_64 acl-2.4.0-1.el8_10.x86_64.rpm SHA-256: 46b6945a8813d2534247b99ce60eb3cbada796397c9986314908c9b76fe93954 acl-debuginfo-2.4.0-1.el8_10.i686.rpm SHA-256: 32b129538a9eb7605a91fc2e13d134acde8f9dafc479a908bf41a9552ee09456 acl-debuginfo-2.4.0-1.el8_10.x86_64.rpm SHA-256: 3614b0022e00dcb9a88683fe23839530f34f8bad5af7101549c15b5c0c37ff44 acl-debugsource-2.4.0-1.el8_10.i686.rpm SHA-256: d6a7ab75194a0b1ad625a30d26154264c4d12eaaa7346cf81139beae2eb2afb7 acl-debugsource-2.4.0-1.el8_10.x86_64.rpm SHA-256: 37923681fae34251cdadb4a7b4e203be6d26b5ebfef5a3e1b09c1143d7596ed5 libacl-2.4.0-1.el8_10.i686.rpm SHA-256: aeddc89aaea16c365729cf06b47e5984758e0f430a5f5b0cbdd8cd7ff7c9c451 libacl-2.4.0-1.el8_10.x86_64.rpm SHA-256: 17f2b882315c9eed038daf3420df6386f3c0fffd810309992fd244f4267edcf0 libacl-debuginfo-2.4.0-1.el8_10.i686.rpm SHA-256: 472e926a46de91200bd1d10fd89968101ec4f63c1c434963f267696b858849f4 libacl-debuginfo-2.4.0-1.el8_10.x86_64.rpm SHA-256: f956f377d483d6e641774844107d6a3fc3d629843e2ed0933b5d23a6940d621d libacl-devel-2.4.0-1.el8_10.i686.rpm SHA-256: 11a632192e0ef6004f7936df498821687e40288a3bef0daa28df0fc3214cc204 libacl-devel-2.4.0-1.el8_10.x86_64.rpm SHA-256: 5ec45b2da906047a47021f0cc1e62a0b8f7feddb50f7dd7df19c6ce0eb3c5471 Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 8.10 SRPM acl-2.4.0-1.el8_10.src.rpm SHA-256: d199a0f051d85a948e775c8e8222eff0de0733b7ca80f9a7a363aa1a5f0bbfbf aarch64 acl-2.4.0-1.el8_10.aarch64.rpm SHA-256: bf67fd777fc00af308a4ad2d4ae55dad8ac0f85520b854f7590c3ebcb8db34da acl-debuginfo-2.4.0-1.el8_10.aarch64.rpm SHA-256: f1baac5e29b262e3cc266d0fe45498cdead1b56f4a77ecb6637ee1058501a24c acl-debugsource-2.4.0-1.el8_10.aarch64.rpm SHA-256: 564a51c9d3db786f1c22001f5fc9a07c3be398b400d2b53cf8d305bc59666215 libacl-2.4.0-1.el8_10.aarch64.rpm SHA-256: 06b28cb70834c0b483ab8ef013565bd02480bbac3b9e4836c233e62b28aff564 libacl-debuginfo-2.4.0-1.el8_10.aarch64.rpm SHA-256: 20f139053fb18c3b0b31c11b77d225e772f7fff1792ab7988c3d809f88f725ea libacl-devel-2.4.0-1.el8_10.aarch64.rpm SHA-256: de0b82bafee5c82d9d66f854f672830b8ea318133445a016975229a09fd54128 Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 8.10 SRPM acl-2.4.0-1.el8_10.src.rpm SHA-256: d199a0f051d85a948e775c8e8222eff0de0733b7ca80f9a7a363aa1a5f0bbfbf ppc64le acl-2.4.0-1.el8_10.ppc64le.rpm SHA-256: 769bce69c9b1e1125ffa0332eac2f21931d7fcf8c6cfa80e5228c62007fe6709 acl-debuginfo-2.4.0-1.el8_10.ppc64le.rpm SHA-256: 37bf16e62d9f50a68c7553cca8feec25548bd239262f88ebde1e56360eab81ed acl-debugsource-2.4.0-1.el8_10.ppc64le.rpm SHA-256: 69214448aa5e6a18e24959b0dc6b1b47f0dfbff6ae100fc74f88558156d0182b libacl-2.4.0-1.el8_10.ppc64le.rpm SHA-256: 3236f00c540867779fdd032e1b75ec499759ee69bf30ff8bf7027f0d557892c8 libacl-debuginfo-2.4.0-1.el8_10.ppc64le.rpm SHA-256: 71feb7493c6ad0b74c5583acf76d66aeff2ed10de75fd5d4965f27b5940f5e5d libacl-devel-2.4.0-1.el8_10.ppc64le.rpm SHA-256: e61c309ff68d45d0cc62ddecee55b9205358eb6c12978ca80c5a84baa91bdc47 Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 8.10 SRPM acl-2.4.0-1.el8_10.src.rpm SHA-256: d199a0f051d85a948e775c8e8222eff0de0733b7ca80f9a7a363aa1a5f0bbfbf s390x acl-2.4.0-1.el8_10.s390x.rpm SHA-256: 069ee5ef36de435b520ece784f517d9692f441acb1cf06e02a090d63ceb714d5 acl-debuginfo-2.4.0-1.el8_10.s390x.rpm SHA-256: edd1f2f6a3bdfc208c8cd895d63f66d36869c8d6ba8428d7d4cf9f4523a5cd79 acl-debugsource-2.4.0-1.el8_10.s390x.rpm SHA-256: 4df37c8db5542fe69cf0dc89f1b75348b2562b61083b9f8422920ef9cf756199 libacl-2.4.0-1.el8_10.s390x.rpm SHA-256: b6cc5a98de9c5b20c4aa7efafff1f856abb572c7fed276ee6fab89d9ea08f406 libacl-debuginfo-2