{
  "document": {
    "aggregate_severity": {
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "TuxCare License Agreement",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Cloud Linux Inc. and provide a link to the original.",
        "title": "Terms of Use"
      },
      {
        "category": "details",
        "text": "* SECURITY UPDATE: TOCTOU symlink traversal in getfacl, setfacl and chacl\n     - debian/patches/CVE-2026-54370.patch: walk trees through directory file\n       descriptors and act on the final pathname component with symlink-safe\n       calls in tools/getfacl.c, tools/setfacl.c, tools/do_set.c and\n       tools/chacl.c\n     - the *at() ACL operations the hardened tools need are private helpers in\n       tools/acl_at.c, so libacl's public ABI and installed headers are\n       unchanged\n     - setfacl --restore is symlink-safe only when invoked with -P: without it\n       the backup's pathnames are still resolved by name, so stat, chown,\n       chmod and the ACL write still follow symlinks; upstream's warning about\n       that is built out with --disable-unsafe-restore-warnings, so --restore\n       output is unchanged for scripts that parse stderr\n     - getfacl -P and setfacl -P now fail with ELOOP on a symlink argument\n       instead of silently ignoring it\n     - in the recursive default mode a toplevel symlink-to-directory argument\n       is now descended into, where 2.2.53 applied to the toplevel entry only;\n       'setfacl -R <symlink-to-dir>' therefore writes to the whole subtree\n       (upstream 2.4.0 walk_tree semantics)\n     - chacl on a symlink given on the command line now fails with \"Operation\n       not supported\" instead of acting on the symlink's target\n     - getfacl no longer strips a leading './' from pathnames, so\n       'getfacl -R ./dir' prints '# file: ./dir' for the toplevel entry\n     - the symlink-safe paths need /proc mounted: without it getfacl and\n       setfacl warn and then fail with EACCES (\"Permission denied\"), instead\n       of falling back to the ACL derived from the file mode, which would\n       drop every named entry and still exit successfully\n     - debian/rules: configure with --disable-unsafe-restore-warnings, and\n       skip test/root/permissions.test and test/root/setfacl.test on build\n       hosts whose build tree is not reachable by unprivileged users, where\n       they fail regardless of this patch\n     - CVE-2026-54370",
        "title": "Details"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://tuxcare.com/contact/",
      "name": "TuxCare",
      "namespace": "https://tuxcare.com/"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://cve.tuxcare.com/els/releases/CLSA-2026:1791892215",
        "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1791892215"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.tuxcare.com/csaf/v2/els_os/debian11els/advisories/2026/clsa-2026_1791892215.json"
      }
    ],
    "tracking": {
      "current_release_date": "2026-10-13T11:51:05Z",
      "generator": {
        "date": "2026-10-13T11:51:05Z",
        "engine": {
          "name": "pyCSAF"
        }
      },
      "id": "CLSA-2026:1791892215",
      "initial_release_date": "2026-10-13T11:51:05Z",
      "revision_history": [
        {
          "date": "2026-10-13T11:51:05Z",
          "number": "1",
          "summary": "Initial version"
        }
      ],
      "status": "final",
      "version": "1"
    },
    "title": "Fix CVE(s): CVE-2026-54370"
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Debian 11",
                "product": {
                  "name": "Debian 11",
                  "product_id": "Debian-11",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:o:debian:debian_linux:11:*:*:*:*:*:*:*"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Debian"
          }
        ],
        "category": "vendor",
        "name": "Software in the Public Interest, Inc."
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "acl-0:2.2.53-10+tuxcare.els1.arm64",
                "product": {
                  "name": "acl-0:2.2.53-10+tuxcare.els1.arm64",
                  "product_id": "acl-0:2.2.53-10+tuxcare.els1.arm64",
                  "product_identification_helper": {
                    "purl": "pkg:deb/tuxcare/acl@2.2.53-10%2Btuxcare.els1?arch=arm64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libacl1-dev-0:2.2.53-10+tuxcare.els1.arm64",
                "product": {
                  "name": "libacl1-dev-0:2.2.53-10+tuxcare.els1.arm64",
                  "product_id": "libacl1-dev-0:2.2.53-10+tuxcare.els1.arm64",
                  "product_identification_helper": {
                    "purl": "pkg:deb/tuxcare/libacl1-dev@2.2.53-10%2Btuxcare.els1?arch=arm64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libacl1-0:2.2.53-10+tuxcare.els1.arm64",
                "product": {
                  "name": "libacl1-0:2.2.53-10+tuxcare.els1.arm64",
                  "product_id": "libacl1-0:2.2.53-10+tuxcare.els1.arm64",
                  "product_identification_helper": {
                    "purl": "pkg:deb/tuxcare/libacl1@2.2.53-10%2Btuxcare.els1?arch=arm64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "arm64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "acl-0:2.2.53-10+tuxcare.els1.amd64",
                "product": {
                  "name": "acl-0:2.2.53-10+tuxcare.els1.amd64",
                  "product_id": "acl-0:2.2.53-10+tuxcare.els1.amd64",
                  "product_identification_helper": {
                    "purl": "pkg:deb/tuxcare/acl@2.2.53-10%2Btuxcare.els1?arch=amd64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libacl1-dev-0:2.2.53-10+tuxcare.els1.amd64",
                "product": {
                  "name": "libacl1-dev-0:2.2.53-10+tuxcare.els1.amd64",
                  "product_id": "libacl1-dev-0:2.2.53-10+tuxcare.els1.amd64",
                  "product_identification_helper": {
                    "purl": "pkg:deb/tuxcare/libacl1-dev@2.2.53-10%2Btuxcare.els1?arch=amd64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libacl1-0:2.2.53-10+tuxcare.els1.amd64",
                "product": {
                  "name": "libacl1-0:2.2.53-10+tuxcare.els1.amd64",
                  "product_id": "libacl1-0:2.2.53-10+tuxcare.els1.amd64",
                  "product_identification_helper": {
                    "purl": "pkg:deb/tuxcare/libacl1@2.2.53-10%2Btuxcare.els1?arch=amd64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "acl-0:2.2.53-10+tuxcare.els1.armel",
                "product": {
                  "name": "acl-0:2.2.53-10+tuxcare.els1.armel",
                  "product_id": "acl-0:2.2.53-10+tuxcare.els1.armel",
                  "product_identification_helper": {
                    "purl": "pkg:deb/tuxcare/acl@2.2.53-10%2Btuxcare.els1?arch=armel"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libacl1-dev-0:2.2.53-10+tuxcare.els1.armel",
                "product": {
                  "name": "libacl1-dev-0:2.2.53-10+tuxcare.els1.armel",
                  "product_id": "libacl1-dev-0:2.2.53-10+tuxcare.els1.armel",
                  "product_identification_helper": {
                    "purl": "pkg:deb/tuxcare/libacl1-dev@2.2.53-10%2Btuxcare.els1?arch=armel"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libacl1-0:2.2.53-10+tuxcare.els1.armel",
                "product": {
                  "name": "libacl1-0:2.2.53-10+tuxcare.els1.armel",
                  "product_id": "libacl1-0:2.2.53-10+tuxcare.els1.armel",
                  "product_identification_helper": {
                    "purl": "pkg:deb/tuxcare/libacl1@2.2.53-10%2Btuxcare.els1?arch=armel"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "armel"
          }
        ],
        "category": "vendor",
        "name": "TuxCare"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "acl-0:2.2.53-10+tuxcare.els1.arm64 as a component of Debian 11",
          "product_id": "Debian-11:acl-0:2.2.53-10+tuxcare.els1.arm64"
        },
        "product_reference": "acl-0:2.2.53-10+tuxcare.els1.arm64",
        "relates_to_product_reference": "Debian-11"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "acl-0:2.2.53-10+tuxcare.els1.amd64 as a component of Debian 11",
          "product_id": "Debian-11:acl-0:2.2.53-10+tuxcare.els1.amd64"
        },
        "product_reference": "acl-0:2.2.53-10+tuxcare.els1.amd64",
        "relates_to_product_reference": "Debian-11"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "acl-0:2.2.53-10+tuxcare.els1.armel as a component of Debian 11",
          "product_id": "Debian-11:acl-0:2.2.53-10+tuxcare.els1.armel"
        },
        "product_reference": "acl-0:2.2.53-10+tuxcare.els1.armel",
        "relates_to_product_reference": "Debian-11"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libacl1-dev-0:2.2.53-10+tuxcare.els1.arm64 as a component of Debian 11",
          "product_id": "Debian-11:libacl1-dev-0:2.2.53-10+tuxcare.els1.arm64"
        },
        "product_reference": "libacl1-dev-0:2.2.53-10+tuxcare.els1.arm64",
        "relates_to_product_reference": "Debian-11"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libacl1-dev-0:2.2.53-10+tuxcare.els1.armel as a component of Debian 11",
          "product_id": "Debian-11:libacl1-dev-0:2.2.53-10+tuxcare.els1.armel"
        },
        "product_reference": "libacl1-dev-0:2.2.53-10+tuxcare.els1.armel",
        "relates_to_product_reference": "Debian-11"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libacl1-dev-0:2.2.53-10+tuxcare.els1.amd64 as a component of Debian 11",
          "product_id": "Debian-11:libacl1-dev-0:2.2.53-10+tuxcare.els1.amd64"
        },
        "product_reference": "libacl1-dev-0:2.2.53-10+tuxcare.els1.amd64",
        "relates_to_product_reference": "Debian-11"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libacl1-0:2.2.53-10+tuxcare.els1.amd64 as a component of Debian 11",
          "product_id": "Debian-11:libacl1-0:2.2.53-10+tuxcare.els1.amd64"
        },
        "product_reference": "libacl1-0:2.2.53-10+tuxcare.els1.amd64",
        "relates_to_product_reference": "Debian-11"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libacl1-0:2.2.53-10+tuxcare.els1.armel as a component of Debian 11",
          "product_id": "Debian-11:libacl1-0:2.2.53-10+tuxcare.els1.armel"
        },
        "product_reference": "libacl1-0:2.2.53-10+tuxcare.els1.armel",
        "relates_to_product_reference": "Debian-11"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libacl1-0:2.2.53-10+tuxcare.els1.arm64 as a component of Debian 11",
          "product_id": "Debian-11:libacl1-0:2.2.53-10+tuxcare.els1.arm64"
        },
        "product_reference": "libacl1-0:2.2.53-10+tuxcare.els1.arm64",
        "relates_to_product_reference": "Debian-11"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-54370",
      "cwe": {
        "id": "CWE-367",
        "name": "Time-of-check Time-of-use (TOCTOU) Race Condition"
      },
      "notes": [
        {
          "category": "description",
          "text": "acl before version 2.4.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability that allows local attackers to escalate privileges by replacing a pathname component with a symbolic link between an lstat() check and subsequent symlink-following operations such as stat(), chown(), chmod(), acl_get_file(), and acl_set_file(). Attackers who control a pathname component can redirect file access control list operations to arbitrary files when getfacl, setfacl, or chacl is invoked by a privileged process over an attacker-controlled path, resulting in local privilege escalation.",
          "title": "Vulnerability description"
        }
      ],
      "product_status": {
        "fixed": [
          "Debian-11:acl-0:2.2.53-10+tuxcare.els1.amd64",
          "Debian-11:acl-0:2.2.53-10+tuxcare.els1.arm64",
          "Debian-11:acl-0:2.2.53-10+tuxcare.els1.armel",
          "Debian-11:libacl1-0:2.2.53-10+tuxcare.els1.amd64",
          "Debian-11:libacl1-0:2.2.53-10+tuxcare.els1.arm64",
          "Debian-11:libacl1-0:2.2.53-10+tuxcare.els1.armel",
          "Debian-11:libacl1-dev-0:2.2.53-10+tuxcare.els1.amd64",
          "Debian-11:libacl1-dev-0:2.2.53-10+tuxcare.els1.arm64",
          "Debian-11:libacl1-dev-0:2.2.53-10+tuxcare.els1.armel"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://cve.tuxcare.com/els/cve/CVE-2026-54370"
        },
        {
          "category": "external",
          "summary": "https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=24a227d0ab8576612194f8a56c2314389adc74a5",
          "url": "https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=24a227d0ab8576612194f8a56c2314389adc74a5"
        },
        {
          "category": "external",
          "summary": "https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=3589787cd589b34bdd9265936e17190b6d3f17d1",
          "url": "https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=3589787cd589b34bdd9265936e17190b6d3f17d1"
        },
        {
          "category": "external",
          "summary": "https://www.vulncheck.com/advisories/acl-toctou-symlink-traversal-via-getfacl-setfacl-chacl",
          "url": "https://www.vulncheck.com/advisories/acl-toctou-symlink-traversal-via-getfacl-setfacl-chacl"
        }
      ],
      "release_date": "2026-06-29T14:16:00Z",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-13T11:50:17.243267Z",
          "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1791892215",
          "product_ids": [
            "Debian-11:acl-0:2.2.53-10+tuxcare.els1.amd64",
            "Debian-11:acl-0:2.2.53-10+tuxcare.els1.arm64",
            "Debian-11:acl-0:2.2.53-10+tuxcare.els1.armel",
            "Debian-11:libacl1-0:2.2.53-10+tuxcare.els1.amd64",
            "Debian-11:libacl1-0:2.2.53-10+tuxcare.els1.arm64",
            "Debian-11:libacl1-0:2.2.53-10+tuxcare.els1.armel",
            "Debian-11:libacl1-dev-0:2.2.53-10+tuxcare.els1.amd64",
            "Debian-11:libacl1-dev-0:2.2.53-10+tuxcare.els1.arm64",
            "Debian-11:libacl1-dev-0:2.2.53-10+tuxcare.els1.armel"
          ],
          "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1791892215"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ]
    }
  ]
}