CVE-2026-16552: systemd systemd-tmpfiles symlink-redirected arbitrary file overwrite

CVE-2026-16552 · Severity: medium · CVSS 6.3 · Published 2026-07-22

A vulnerability in systemd-tmpfiles, a utility used to manage temporary files and directories, could allow a local user to trick the system into overwriting sensitive system files. By placing a symbolic link in a directory they control, an attacker can redirect a privileged file-writing operation to a different location on the system. While the attacker cannot choose the specific content being written, they can cause critical system files to be corrupted or replaced with predefined configuration data, potentially leading to system instability or a loss of integrity.

Quick answers

Is CVE-2026-16552 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-16552 being exploited in the wild.
How severe is CVE-2026-16552?
Medium severity, with a CVSS score of 6.3, published 22 July 2026.
Which products and versions are affected?
Red Hat Red Hat Enterprise Linux 10 systemd 257; Red Hat Red Hat Enterprise Linux 9 systemd 252; Red Hat Red Hat Enterprise Linux 8 systemd 239; Red Hat Red Hat Enterprise Linux 7 systemd 219; and 2 more.
Is there a fix for CVE-2026-16552?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-16552 attacked?
It is attacked with local access, in an operating system.
Am I affected by CVE-2026-16552?
Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A flaw exists in systemd-tmpfiles where the 'w' item type (write_one_file) follows terminal symbolic links without using O_NOFOLLOW. Additionally, the uid_unsafe_transition() function in chase.c contains a logic error that treats any path transition starting from UID 0 (root) as safe, failing to detect when a privileged process enters a directory owned by an unprivileged user. An attacker can exploit this by placing a symlink in a user-writable directory (like /run/user/<uid>) that points to a root-owned file. If a tmpfiles.d configuration targets that path, systemd-tmpfiles will follow the link and overwrite the target file with the content specified in the configuration. This affects systemd versions across multiple RHEL releases, though the underlying root cause differs slightly in older versions (RHEL 7/8) that predate the CHASE_SAFE refactor.

Affected products

  • Red Hat Red Hat Enterprise Linux 10 systemd 257
  • Red Hat Red Hat Enterprise Linux 9 systemd 252
  • Red Hat Red Hat Enterprise Linux 8 systemd 239
  • Red Hat Red Hat Enterprise Linux 7 systemd 219
  • Red Hat Red Hat OpenShift Container Platform 4
  • systemd systemd

Timeline

  • 2026-07-22: disclosed: Vulnerability reported via Red Hat Bugzilla
  • 2026-07-22: advisory: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.