ELSA-2026-43420

ELSA-2026-43420 - acl security update

Type:	SECURITY
Impact:	IMPORTANT
Release Date:	2026-07-22

Description

[2.4.0-1]
- rebase to 2.4.0 to fix the following CVEs:
- CVE-2026-54369 - Symlink traversal privilege escalation via libacl functions (RHEL-186111)
- CVE-2026-54370 - TOCTOU Symlink Traversal via getfacl/setfacl (RHEL-186216)

Related CVEs

CVE-2026-54369

CVE-2026-54370

Updated Packages

Release/Architecture	Filename	sha256	Superseded By Advisory	Channel Label
Oracle Linux 8 (aarch64)	acl-2.4.0-1.el8_10.src.rpm	d6485d13561b21f2881ab210d0a709fdd49af29bf8b4f6cf81f133f6798694eb	-	ol8_aarch64_baseos_latest
	acl-2.4.0-1.el8_10.src.rpm	d6485d13561b21f2881ab210d0a709fdd49af29bf8b4f6cf81f133f6798694eb	-	ol8_aarch64_u10_baseos_patch
	acl-2.4.0-1.el8_10.aarch64.rpm	725a29151d71dab17212c7117c76f118a97e394d41ec7d61089e49dc80bb2376	-	ol8_aarch64_baseos_latest
	acl-2.4.0-1.el8_10.aarch64.rpm	725a29151d71dab17212c7117c76f118a97e394d41ec7d61089e49dc80bb2376	-	ol8_aarch64_u10_baseos_patch
	libacl-2.4.0-1.el8_10.aarch64.rpm	c47af7097ef28abc0d932233ae8aaef3d935b8b61717ad13878b974847b6eed5	-	ol8_aarch64_baseos_latest
	libacl-2.4.0-1.el8_10.aarch64.rpm	c47af7097ef28abc0d932233ae8aaef3d935b8b61717ad13878b974847b6eed5	-	ol8_aarch64_u10_baseos_patch
	libacl-devel-2.4.0-1.el8_10.aarch64.rpm	71b3ed31919b59a754c3b149bbd90ba12216d6b35a47a74bf05255d4072f12db	-	ol8_aarch64_baseos_latest
	libacl-devel-2.4.0-1.el8_10.aarch64.rpm	71b3ed31919b59a754c3b149bbd90ba12216d6b35a47a74bf05255d4072f12db	-	ol8_aarch64_u10_baseos_patch
Oracle Linux 8 (x86_64)	acl-2.4.0-1.el8_10.src.rpm	d6485d13561b21f2881ab210d0a709fdd49af29bf8b4f6cf81f133f6798694eb	-	ol8_x86_64_baseos_latest
	acl-2.4.0-1.el8_10.src.rpm	d6485d13561b21f2881ab210d0a709fdd49af29bf8b4f6cf81f133f6798694eb	-	ol8_x86_64_u10_baseos_patch
	acl-2.4.0-1.el8_10.x86_64.rpm	9f03e28ae8c0449ec6f9a7d4285631cf4d29991f1ef6d5258650d936dcc20c4a	-	ol8_x86_64_baseos_latest
	acl-2.4.0-1.el8_10.x86_64.rpm	9f03e28ae8c0449ec6f9a7d4285631cf4d29991f1ef6d5258650d936dcc20c4a	-	ol8_x86_64_u10_baseos_patch
	libacl-2.4.0-1.el8_10.i686.rpm	2ab259b77d0fc2873b18a0d7ee5358187060081ffe84bd26cf45541cc33aeacd	-	ol8_x86_64_baseos_latest
	libacl-2.4.0-1.el8_10.i686.rpm	2ab259b77d0fc2873b18a0d7ee5358187060081ffe84bd26cf45541cc33aeacd	-	ol8_x86_64_u10_baseos_patch
	libacl-2.4.0-1.el8_10.x86_64.rpm	fd18d5b905a185ecb31fdece22e3b4d90dfde56dbf5a3baea8f89028884eb977	-	ol8_x86_64_baseos_latest
	libacl-2.4.0-1.el8_10.x86_64.rpm	fd18d5b905a185ecb31fdece22e3b4d90dfde56dbf5a3baea8f89028884eb977	-	ol8_x86_64_u10_baseos_patch
	libacl-devel-2.4.0-1.el8_10.i686.rpm	0cb268cddd129a1c5f02989e23712beb121d510b6e02f5be3a960096dcb37e79	-	ol8_x86_64_baseos_latest
	libacl-devel-2.4.0-1.el8_10.i686.rpm	0cb268cddd129a1c5f02989e23712beb121d510b6e02f5be3a960096dcb37e79	-	ol8_x86_64_u10_baseos_patch
	libacl-devel-2.4.0-1.el8_10.x86_64.rpm	b56758720c8f6e22689867b2fd2b371e3d3cd7654dc8ece30432ebf1e5ec2156	-	ol8_x86_64_baseos_latest
	libacl-devel-2.4.0-1.el8_10.x86_64.rpm	b56758720c8f6e22689867b2fd2b371e3d3cd7654dc8ece30432ebf1e5ec2156	-	ol8_x86_64_u10_baseos_patch

This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections please contact the Oracle Linux ULN team