acl before version 2.4.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability that allows local attackers to escalate privileges by replacing a pathname component with a symbolic link between an lstat() check and subsequent symlink-following operations such as stat(), chown(), chmod(), acl_get_file(), and acl_set_file(). Attackers who control a pathname component can redirect file access control list operations to arbitrary files when getfacl, setfacl, or chacl is invoked by a privileged process over an attacker-controlled path, resulting in local privilege escalation.

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:43420 advisory.

    * acl: Symlink traversal privilege escalation via libacl functions (CVE-2026-54369)

    * acl: TOCTOU Symlink Traversal via getfacl/setfacl (CVE-2026-54370)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:42739 advisory.

    * acl: Symlink traversal privilege escalation via libacl functions (CVE-2026-54369)

    * acl: TOCTOU Symlink Traversal via getfacl/setfacl (CVE-2026-54370)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:42736 advisory.

    * acl: Symlink traversal privilege escalation via libacl functions (CVE-2026-54369)

    * acl: TOCTOU Symlink Traversal via getfacl/setfacl (CVE-2026-54370)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:42739 advisory.

    * acl: Symlink traversal privilege escalation via libacl functions (CVE-2026-54369)
      * acl: TOCTOU Symlink Traversal via getfacl/setfacl (CVE-2026-54370)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:43420 advisory.

    * acl: Symlink traversal privilege escalation via libacl functions (CVE-2026-54369)
      * acl: TOCTOU Symlink Traversal via getfacl/setfacl (CVE-2026-54370)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:42736 advisory.

    * acl: Symlink traversal privilege escalation via libacl functions (CVE-2026-54369)
      * acl: TOCTOU Symlink Traversal via getfacl/setfacl (CVE-2026-54370)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:43420 advisory.

    Access Control Lists (ACLs) are used to define fine-grained discretionary access rights for files and     directories. The acl packages contain the getfacl and setfacl utilities needed for manipulating access     control lists.

    Security Fix(es):

    * acl: Symlink traversal privilege escalation via libacl functions (CVE-2026-54369)

    * acl: TOCTOU Symlink Traversal via getfacl/setfacl (CVE-2026-54370)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-42739 advisory.

    [2.4.0-1]
    - rebase to 2.4.0 to fix the following CVEs:
      - CVE-2026-54369 - Symlink traversal privilege escalation via libacl functions (RHEL-186106)
      - CVE-2026-54370 - TOCTOU Symlink Traversal via getfacl/setfacl (RHEL-186207)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-42736 advisory.

    [2.4.0-1]
    - rebase to 2.4.0 to fix the following CVEs:
      - CVE-2026-54369 - Symlink traversal privilege escalation via libacl functions (RHEL-186111)
      - CVE-2026-54370 - TOCTOU Symlink Traversal via getfacl/setfacl (RHEL-186216)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:42736 advisory.

    Access Control Lists (ACLs) are used to define fine-grained discretionary access rights for files and     directories. The acl packages contain the getfacl and setfacl utilities needed for manipulating access     control lists.

    Security Fix(es):

    * acl: Symlink traversal privilege escalation via libacl functions (CVE-2026-54369)

    * acl: TOCTOU Symlink Traversal via getfacl/setfacl (CVE-2026-54370)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:42739 advisory.

    Access Control Lists (ACLs) are used to define fine-grained discretionary access rights for files and     directories. The acl packages contain the getfacl and setfacl utilities needed for manipulating access     control lists.

    Security Fix(es):

    * acl: Symlink traversal privilege escalation via libacl functions (CVE-2026-54369)

    * acl: TOCTOU Symlink Traversal via getfacl/setfacl (CVE-2026-54370)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1986 advisory.

    A flaw was found in the `acl` component, specifically within its `libacl` pathname-based functions. A     local attacker could exploit this vulnerability by using a symbolic link to replace a pathname component.
    This could allow the attacker to redirect access control list (ACL) read or write operations to arbitrary     files or directories, leading to unauthorized manipulation of ACLs and ultimately local privilege     escalation. (CVE-2026-54369)

    A time-of-check to time-of-use (TOCTOU) race condition vulnerability was found in acl. By replacing a     pathname component with a symbolic link between a security check and subsequent file operations, an     attacker can redirect file access control list operations. This occurs when privileged processes invoke     `getfacl` or `setfacl` over an attacker-controlled path, potentially leading to local privilege     escalation. (CVE-2026-54370)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-67504c329b advisory.

    * rebase to v2.4.0 to fix CVE-2026-54369 and CVE-2026-54370

    Resolves: CVE-2026-54369     Resolves: CVE-2026-54370

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-6b9a652463 advisory.

    * rebase to v2.4.0 to fix CVE-2026-54369 and CVE-2026-54370

    Resolves: CVE-2026-54369     Resolves: CVE-2026-54370

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - acl before version 2.4.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability     that allows local attackers to escalate privileges by replacing a pathname component with a symbolic link     between an lstat() check and subsequent symlink-following operations such as stat(), chown(), chmod(),     acl_get_file(), and acl_set_file(). Attackers who control a pathname component can redirect file access     control list operations to arbitrary files when getfacl, setfacl, or chacl is invoked by a privileged     process over an attacker-controlled path, resulting in local privilege escalation. (CVE-2026-54370)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
329188	RockyLinux 8 : acl (RLSA-2026:43420)	Nessus	Rocky Linux Local Security Checks	high
329053	RockyLinux 10 : acl (RLSA-2026:42739)	Nessus	Rocky Linux Local Security Checks	high
329050	RockyLinux 9 : acl (RLSA-2026:42736)	Nessus	Rocky Linux Local Security Checks	high
328985	AlmaLinux 10 : acl (ALSA-2026:42739)	Nessus	Alma Linux Local Security Checks	high
328984	AlmaLinux 8 : acl (ALSA-2026:43420)	Nessus	Alma Linux Local Security Checks	high
328971	AlmaLinux 9 : acl (ALSA-2026:42736)	Nessus	Alma Linux Local Security Checks	high
328948	RHEL 8 : acl (RHSA-2026:43420)	Nessus	Red Hat Local Security Checks	high
328892	Oracle Linux 10 : acl (ELSA-2026-42739)	Nessus	Oracle Linux Local Security Checks	high
328858	Oracle Linux 9 : acl (ELSA-2026-42736)	Nessus	Oracle Linux Local Security Checks	high
328857	RHEL 9 : acl (RHSA-2026:42736)	Nessus	Red Hat Local Security Checks	high
328802	RHEL 10 : acl (RHSA-2026:42739)	Nessus	Red Hat Local Security Checks	high
328504	Amazon Linux 2023 : acl, libacl, libacl-devel (ALAS2023-2026-1986)	Nessus	Amazon Linux Local Security Checks	high
326431	Fedora 43 : acl (2026-67504c329b)	Nessus	Fedora Local Security Checks	high
326364	Fedora 44 : acl (2026-6b9a652463)	Nessus	Fedora Local Security Checks	high
323758	Linux Distros Unpatched Vulnerability : CVE-2026-54370	Nessus	Misc.	high

Detections

Analytics

CVE-2026-54370

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high