CVE-2026-54371
Publication date 29 June 2026
Last updated 31 August 2026
Ubuntu priority
Medium
Description
attr before version 2.6.0 contains a symlink traversal vulnerability in the getfattr and setfattr utilities that allows local attackers to escalate privileges by replacing a pathname component with a symbolic link during directory hierarchy traversal. Attackers who control a pathname component can redirect getfattr and setfattr operations to arbitrary files by substituting a symlink, leading to local privilege escalation when getfattr or setfattr is invoked by a privileged process over an attacker-controlled path.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| attr | 26.04 LTS resolute |
Fixed 1:2.5.2-4ubuntu0.1
|
| 25.10 questing | Ignored end of life, was needs-triage | |
| 24.04 LTS noble |
Fixed 1:2.5.2-1ubuntu0.1
|
|
| 22.04 LTS jammy |
Fixed 1:2.5.1-1ubuntu0.1
|
|
| 20.04 LTS focal |
Fixed 1:2.4.48-5ubuntu0.1~esm1
|
|
| 18.04 LTS bionic |
Fixed 1:2.4.47-2ubuntu0.18.04.1~esm1
|
|
| 16.04 LTS xenial |
Fixed 1:2.4.47-2ubuntu0.16.04.1~esm1
|
|
| 14.04 LTS trusty |
Fixed 1:2.4.47-1ubuntu1+esm1
|
Get expanded security coverage with Ubuntu Pro
Reduce your average CVE exposure time from 98 days to 1 day with expanded CVE patching, ten-years security maintenance and optional support for the full stack of open-source applications. Free for personal use.
Get Ubuntu Pro 30-day free trialNotes
mdeslaur
attr developer recommends to update to new version, but this may conflict with tar, amongst others, see "Compatibility Notes": https://www.openwall.com/lists/oss-security/2026/06/29/1
Patch details
For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?
| Package | Patch details |
|---|---|
| attr |
Severity score breakdown
CVSS version:
Base score 8.4 · High
Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Base score 7.1 · High
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
References
Related Ubuntu Security Notices (USN)
- USN-8691-1
- attr vulnerability
- 31 August 2026
Other references
- https://www.cve.org/CVERecord?id=CVE-2026-54371
- https://www.openwall.com/lists/oss-security/2026/06/29/1
- https://www.vulncheck.com/advisories/attr-symlink-traversal-privilege-escalation-via-getfattr-setfattr
- https://access.redhat.com/security/cve/CVE-2026-54371
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54371.json