Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
AlmaLinux ACL packages can grant unauthorized file access
published 3 months ago
Summary
The Access Control List (ACL) libraries used in AlmaLinux (acl, libacl, libacl-devel) have a weakness that could let an attacker bypass normal file permissions and read or modify protected files. Updating these packages to version 2.4.0 or newer removes the issue and restores proper file access controls.
What to do
- Update almalinux acl to version 2.4.0-1.el9_6.tuxcare.els1.
- Update almalinux libacl to version 2.4.0-1.el9_6.tuxcare.els1.
- Update almalinux libacl-devel to version 2.4.0-1.el9_6.tuxcare.els1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| TuxCare:AlmaLinux:9.6 | almalinux | acl |
< 2.4.0-1.el9_6.tuxcare.els1 Fix: upgrade to 2.4.0-1.el9_6.tuxcare.els1
|
| TuxCare:AlmaLinux:9.6 | almalinux | libacl |
< 2.4.0-1.el9_6.tuxcare.els1 Fix: upgrade to 2.4.0-1.el9_6.tuxcare.els1
|
| TuxCare:AlmaLinux:9.6 | almalinux | libacl-devel |
< 2.4.0-1.el9_6.tuxcare.els1 Fix: upgrade to 2.4.0-1.el9_6.tuxcare.els1
|
Original advisory text
acl: Fix of 2 CVEs
- rebase to 2.4.0 to fix CVE-2026-54369 and CVE-2026-54370
References
- https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1784982822.html Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-54369 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-54370 Vendor Advisory
Timeline
Published28 Jul 2026
Updated26 Oct 2026
First seen26 Oct 2026
Sources
CLSA-2026-1784982822 · OSV
Track software like this
Free during beta