Back Linuxsecurity

Fedora 44 attr Critical Symlink Traversal Escalation Vuln CVE-2026

Linuxsecurity •LinuxSecurity Advisories • July 11, 2026

* Thu Jul 9 2026 Lukáš Zaoral - 2.6.0-1 - rebase to v2.6.0 to fix the following CVEs: - CVE-2026-54371 - Symlink Traversal Privilege Escalation via getfattr (rhbz#2494172)

[ 1 ] Bug #2494172 - CVE-2026-54371 attr: Symlink Traversal Privilege Escalation via getfattr [fedora-all]

This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-daa458d11d' at the command line. For more information, refer to the dnf documentation available at

Get the latest Linux and open source security news straight to your inbox.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Symlink Traversal Vulnerabilities in Fedora 44 Affected by CVEs On July 9, 2026, Fedora released updates addressing critical symlink traversal vulnerabilities in its acl and attr packages. The vulnerabilities, identified as CVE-2026-54369, CVE-2026-54370, and CVE-2026-54371, were published on June 29, 2026. CVE-2026-54369 and CVE-2026-54370 involve privilege escalation via libacl functions and TOCTOU symlink traversal through getfacl/setfacl. CVE-2026-54371 also presents a privilege escalation risk via getfattr. These vulnerabilities could allow attackers to gain elevated privileges on affected systems. Users are advised to upgrade to the latest versions using the provided dnf commands. The updates are critical for maintaining system security against potential exploitation. 7 sources 73

Extracted Entities

Fedora 44 attr Critical Symlink Traversal Escalation Vuln CVE-2026

The full story

Extracted Entities

Companies (1)

CVEs (1)

CWE Weaknesses (2)

MITRE ATT&CK (1)

Vulnerabilities (1)