Junglewise Threat Intelligence

CVE-2026-16552: systemd systemd-tmpfiles symlink-redirected arbitrary file overwrite

CVE-2026-16552 · Severity: medium · CVSS 6.3 · Published 2026-07-22

Technologies: Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 7, Systemd, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 10. Vendors: Red Hat.

Executive brief

A vulnerability in systemd-tmpfiles, a utility used to manage temporary files and directories, could allow a local user to trick the system into overwriting sensitive system files. By placing a symbolic link in a directory they control, an attacker can redirect a privileged file-writing operation to a different location on the system. While the attacker cannot choose the specific content being written, they can cause critical system files to be corrupted or replaced with predefined configuration data, potentially leading to system instability or a loss of integrity.

Technical details

A flaw exists in systemd-tmpfiles where the 'w' item type (write_one_file) follows terminal symbolic links without using O_NOFOLLOW. Additionally, the uid_unsafe_transition() function in chase.c contains a logic error that treats any path transition starting from UID 0 (root) as safe, failing to detect when a privileged process enters a directory owned by an unprivileged user. An attacker can exploit this by placing a symlink in a user-writable directory (like /run/user/<uid>) that points to a root-owned file. If a tmpfiles.d configuration targets that path, systemd-tmpfiles will follow the link and overwrite the target file with the content specified in the configuration. This affects systemd versions across multiple RHEL releases, though the underlying root cause differs slightly in older versions (RHEL 7/8) that predate the CHASE_SAFE refactor.

Affected products

  • Red Hat Red Hat Enterprise Linux 10 systemd 257
  • Red Hat Red Hat Enterprise Linux 9 systemd 252
  • Red Hat Red Hat Enterprise Linux 8 systemd 239
  • Red Hat Red Hat Enterprise Linux 7 systemd 219
  • Red Hat Red Hat OpenShift Container Platform 4
  • systemd systemd

Timeline

  • 2026-07-22: disclosed: Vulnerability reported via Red Hat Bugzilla
  • 2026-07-22: advisory: NVD publication date

References