CVE-2026-54370

A time-of-check to time-of-use (TOCTOU) race condition vulnerability was found in acl. By replacing a pathname component with a symbolic link between a security check and subsequent file operations, an attacker can redirect file access control list operations. This occurs when privileged processes invoke getfacl or setfacl over an attacker-controlled path, potentially leading to local privilege escalation.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.