ELSA-2026-42736

ELSA-2026-42736 - acl security update

Type:	SECURITY
Impact:	IMPORTANT
Release Date:	2026-07-21

Description

[2.4.0-1]
- rebase to 2.4.0 to fix the following CVEs:
- CVE-2026-54369 - Symlink traversal privilege escalation via libacl functions (RHEL-186111)
- CVE-2026-54370 - TOCTOU Symlink Traversal via getfacl/setfacl (RHEL-186216)

Related CVEs

CVE-2026-54369

CVE-2026-54370

Updated Packages

Release/Architecture	Filename	sha256	Superseded By Advisory	Channel Label
Oracle Linux 9 (aarch64)	acl-2.4.0-1.el9_8.src.rpm	fc76642a2907de17ada51daa303c33e33f63209b43028fe1cb5920c0c7d8071c	-	ol9_aarch64_appstream
	acl-2.4.0-1.el9_8.src.rpm	fc76642a2907de17ada51daa303c33e33f63209b43028fe1cb5920c0c7d8071c	-	ol9_aarch64_baseos_latest
	acl-2.4.0-1.el9_8.src.rpm	fc76642a2907de17ada51daa303c33e33f63209b43028fe1cb5920c0c7d8071c	-	ol9_aarch64_u8_baseos_patch
	acl-2.4.0-1.el9_8.aarch64.rpm	9ba1e767c134f702f5849d4be51c5eecced0295ec27192ff98789c0e6ca0f51d	-	ol9_aarch64_baseos_latest
	acl-2.4.0-1.el9_8.aarch64.rpm	9ba1e767c134f702f5849d4be51c5eecced0295ec27192ff98789c0e6ca0f51d	-	ol9_aarch64_u8_baseos_patch
	libacl-2.4.0-1.el9_8.aarch64.rpm	bf1fb1bdb3fe48c3e5344f238ffac09743783baa75a2fc82195e1f8031a1658e	-	ol9_aarch64_baseos_latest
	libacl-2.4.0-1.el9_8.aarch64.rpm	bf1fb1bdb3fe48c3e5344f238ffac09743783baa75a2fc82195e1f8031a1658e	-	ol9_aarch64_u8_baseos_patch
	libacl-devel-2.4.0-1.el9_8.aarch64.rpm	c942ef10e2cbd44bd4f894872aa5b18e5316770eb3548603241fcc9d4a215fd2	-	ol9_aarch64_appstream
Oracle Linux 9 (x86_64)	acl-2.4.0-1.el9_8.src.rpm	fc76642a2907de17ada51daa303c33e33f63209b43028fe1cb5920c0c7d8071c	-	ol9_x86_64_appstream
	acl-2.4.0-1.el9_8.src.rpm	fc76642a2907de17ada51daa303c33e33f63209b43028fe1cb5920c0c7d8071c	-	ol9_x86_64_baseos_latest
	acl-2.4.0-1.el9_8.src.rpm	fc76642a2907de17ada51daa303c33e33f63209b43028fe1cb5920c0c7d8071c	-	ol9_x86_64_u8_baseos_patch
	acl-2.4.0-1.el9_8.x86_64.rpm	d4628655803051bff87a69bde9d48ca3944e6c7b5cd553da38cb1853a725272c	-	ol9_x86_64_baseos_latest
	acl-2.4.0-1.el9_8.x86_64.rpm	d4628655803051bff87a69bde9d48ca3944e6c7b5cd553da38cb1853a725272c	-	ol9_x86_64_u8_baseos_patch
	libacl-2.4.0-1.el9_8.i686.rpm	b30330c4bbec9a43b6384ec926c60835a7164bed6acb56e97eede625ead15e0c	-	ol9_x86_64_baseos_latest
	libacl-2.4.0-1.el9_8.i686.rpm	b30330c4bbec9a43b6384ec926c60835a7164bed6acb56e97eede625ead15e0c	-	ol9_x86_64_u8_baseos_patch
	libacl-2.4.0-1.el9_8.x86_64.rpm	d24afd6f5e81fc4754ec05c267035eca07538fbf8cbdc9cdb64550d482a9adb2	-	ol9_x86_64_baseos_latest
	libacl-2.4.0-1.el9_8.x86_64.rpm	d24afd6f5e81fc4754ec05c267035eca07538fbf8cbdc9cdb64550d482a9adb2	-	ol9_x86_64_u8_baseos_patch
	libacl-devel-2.4.0-1.el9_8.i686.rpm	00b4eea3f9497883a2a48c8d162445bf943d62314cf3457186bd1558439aafd0	-	ol9_x86_64_appstream
	libacl-devel-2.4.0-1.el9_8.x86_64.rpm	3b4437d6db8cf833ac58a5e41d7261bfe4f2a08386eb033d83876aefbee93718	-	ol9_x86_64_appstream

This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections please contact the Oracle Linux ULN team