CoreCVE
Back

HIGH

TOCTOU permits root escape on Linux via Root.Chmod in os in internal/syscall/unix

Published Apr 8, 2026

Description

On Linux, if the target of Root.Chmod is replaced with a symlink while the chmod operation is in progress, Chmod can operate on the target of the symlink, even when the target lies outside the root. The Linux fchmodat syscall silently ignores the AT_SYMLINK_NOFOLLOW flag, which Root.Chmod uses to avoid symlink traversal. Root.Chmod checks its target before acting and returns an error if the target is a symlink lying outside the root, so the impact is limited to cases where the target is replaced with a symlink between the check and operation.

Affected products

Remediation

Red Hat statement

To exploit this issue, an attacker needs access to the system and the required permissions to create a symbolic link. Additionally, the attacker must swap the target file with a symbolic link in the exact window after the `Root.Chmod` function checks its target but before acting. Due to these conditions, this flaw has been rated with a moderate severity.

Red Hat mitigation

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

Metrics

Weaknesses (2)

CWE-367

CWE-59

References (8)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner Go
Published Apr 8, 2026
Updated Apr 13, 2026
Reserved Mar 11, 2026
Link CVE-2026-32282
CISA Vulnrichment
Updated Apr 13, 2026
NVD
Status Analyzed
Modified Jul 25, 2026
Link CVE-2026-32282
Red Hat
Severity Moderate
Public date Apr 8, 2026
Links CVE-2026-32282 - Bugzilla