ROOT-OS-DEBIAN-13-CVE-2026-54370 CVE-2026-54370 in acl - Patched by Root

Root has patched CVE-2026-54370 in the acl package for Root:Debian:13. Multiple fixed versions available...

ROOT-OS-DEBIAN-12-CVE-2026-54370 CVE-2026-54370 in acl - Patched by Root

Root has patched CVE-2026-54370 in the acl package for Root:Debian:12. Multiple fixed versions available...

AlmaLinux 9 : acl (ALSA-2026:42736)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:42736 advisory. acl: Symlink traversal privilege escalation via libacl functions CVE-2026-54369 acl: TOCTOU Symlink Traversal via getfacl/setfacl CVE-2026-54370 Tenable...

Oracle Linux 10 : acl (ELSA-2026-42739)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-42739 advisory. 2.4.0-1 - rebase to 2.4.0 to fix the following CVEs: - CVE-2026-54369 - Symlink traversal privilege escalation via libacl functions RHEL-186106 -...

CVE-2026-54370

creationtimestamp| type| source ---|---|--- 2026-07-21 12:01:17+00:00| seen| https://bsky.app/profile/lambdawatchdog.bsky.social/post/3mr5r5uytuq2r 2026-07-30 12:01:25+00:00| seen| https://bsky.app/profile/lambdawatchdog.bsky.social/post/3mrufedkcaz2i...

acl security update

2.4.0-1 - rebase to 2.4.0 to fix the following CVEs: - CVE-2026-54369 - Symlink traversal privilege escalation via libacl functions RHEL-186111 - CVE-2026-54370 - TOCTOU Symlink Traversal via getfacl/setfacl RHEL-186216...

DEBIAN-CVE-2026-54370

acl before version 2.4.0 contains a time-of-check to time-of-use TOCTOU race condition vulnerability that allows local attackers to escalate privileges by replacing a pathname component with a symbolic link between an lstat check and subsequent symlink-following operations such as stat, chown,...