CVE-2026-32282
mediumpriority · track · 26EPSS 0.003 · 22 %ileDEEUFRRUUSEPSS · scored 2026-10-27
On Linux, if the target of Root.Chmod is replaced with a symlink while the chmod operation is in progress, Chmod can operate on the target of the symlink, even when the target lies outside the root. The Linux fchmodat syscall silently ignores the AT_SYMLINK_NOFOLLOW flag, which Root.Chmod uses to avoid symlink traversal. Root.Chmod checks its target before acting and returns an error if the target is a symlink lying outside the root, so the impact is limited to cases where the target is replaced with a symlink between the check and operation.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (78)
Products and version ranges known to be affected.
- Red Hat Ansible Automation Platform 2.5all versionscert_bundDEcpe:/a:redhat:ansible_automation_platform:2.5
- Red Hat Ansible Automation Platform 2.6all versionscert_bundDEcpe:/a:redhat:ansible_automation_platform:2.6
- Red Hat Enterprise Linux 10.0 Extended Update Supportall versionscert_bundDEcpe:/o:redhat:enterprise_linux:10.0_extended_update_support
- Red Hat Enterprise Linux 9.6 Extended Update Supportall versionscert_bundDEcpe:/o:redhat:enterprise_linux:9.6_extended_update_support
- Red Hat Enterprise Linux Advanced Cluster Securityall versionscert_bundDEcpe:/o:redhat:enterprise_linux:advanced_cluster_security
- Red Hat Enterprise Linux Edge Managerall versionscert_bundDEcpe:/o:redhat:enterprise_linux:edge_manager
- Red Hat OpenShift API for Data Protectionall versionscert_bundDEcpe:/a:redhat:openshift:api_for_data_protection
- Red Hat OpenShift Container Platformall versionscert_bundDEcpe:/a:redhat:openshift:container_platform
- Red Hat OpenShift Network Observability 1.11.2all versionscert_bundDEcpe:/a:redhat:openshift:network_observability_1.11.2
advisories (5)
Vendor and ecosystem advisories describing this.
- WID-SEC-W-2026-1006Golang Go: Mehrere SchwachstellenDeutsch2026-04-07csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Golang Go ausnutzen, um Speicherbeschädigungen zu verursachen, beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, einen Denial-of-Service-Zustand auszulösen oder andere, nicht näher spezifizierte Angriffe durchzuführen.
- WID-SEC-W-2026-2166Red Hat Satellite (foreman, python-pillow, go): Mehrere SchwachstellenDeutsch2026-07-01csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Red Hat Satellite ausnutzen, um sich erweiterte Rechte, einschließlich Administratorrechte, zu verschaffen, die Authentifizierung zu umgehen, Daten zu manipulieren, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand zu verursachen.
- BIT-golang-2026-32282TOCTOU permits root escape on Linux via Root.Chmod in os in internal/syscall/unix2026-04-13vendor · osvUS
On Linux, if the target of Root.Chmod is replaced with a symlink while the chmod operation is in progress, Chmod can operate on the target of the symlink, even when the target lies outside the root. The Linux fchmodat syscall silently ignores the AT_SYMLINK_NOFOLLOW flag, which Root.Chmod uses to avoid symlink traversal. Root.Chmod checks its target before acting and returns an error if the target is a symlink lying outside the root, so the impact is limited to cases where the target is replaced with a symlink between the check and operation.
- CERTFR-2026-AVI-1385Multiples vulnérabilités dans les produits VMwareFrançais2026-10-26vendor · certfrFR
- GO-2026-4864TOCTOU permits root escape on Linux via Root.Chmod in os in internal/syscall/unix2026-04-07vendor · osvUS
On Linux, if the target of Root.Chmod is replaced with a symlink while the chmod operation is in progress, Chmod can operate on the target of the symlink, even when the target lies outside the root. The Linux fchmodat syscall silently ignores the AT_SYMLINK_NOFOLLOW flag, which Root.Chmod uses to avoid symlink traversal. Root.Chmod checks its target before acting and returns an error if the target is a symlink lying outside the root, so the impact is limited to cases where the target is replaced with a symlink between the check and operation.
also known as (5)
Other names and identifiers for this entity.
- CNNVD-202604-1886cnnvd
- EUVD-2026-20012enisa_euvd
- BDU:2026-07252fstec_bdu
- BIT-golang-2026-32282osv
- GO-2026-4864osv
sources
Which sources assert this record, and when.
references (13)
External citations — patches, advisories, analysis.
- https://go.dev/cl/763761cnnvd
- https://go.dev/doc/devel/releasePatchcnnvd
- https://go.dev/issue/78293cnnvd
- https://groups.google.com/g/golang-announce/c/0uYbvbPZRWUcnnvd
- https://pkg.go.dev/vuln/GO-2026-4864cnnvd
- https://go.dev/cl/763761enisa_euvd
- https://go.dev/issue/78293enisa_euvd
- https://groups.google.com/g/golang-announce/c/0uYbvbPZRWUenisa_euvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan