Executive Summary

CVE-2026-32282 is a vulnerability in the Go programming language's Root.Chmod function on Linux systems. It occurs when the target file of a chmod operation is replaced with a symbolic link (symlink) during the operation. Because the underlying Linux system call fchmodat ignores the AT_SYMLINK_NOFOLLOW flag, Root.Chmod may inadvertently change the permissions of the symlink's target file, even if that target lies outside the intended root directory.

Root.Chmod performs an initial check to ensure the target is not a symlink outside the root and returns an error if so. However, a race condition exists where the target can be swapped with a symlink after this check but before the chmod operation, allowing the function to operate on unintended files.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow unauthorized modification of file permissions on files outside the intended root directory. An attacker could exploit the race condition to replace a target file with a symlink pointing to a sensitive file elsewhere, causing Root.Chmod to change permissions on that sensitive file.

Such unauthorized permission changes could lead to privilege escalation, unauthorized access, or disruption of system security policies.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves a race condition in the Go standard library's Root.Chmod function on Linux systems, where a target file is replaced by a symlink during a chmod operation. Detection would involve monitoring for unexpected permission changes on files outside intended root directories, especially those triggered by Go programs using vulnerable versions.

There are no specific detection commands or network/system scanning commands provided in the available resources.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, update the Go programming language to version 1.27 or later, where the Root.Chmod function has been fixed.

The fix involves using the Linux fchmodat2 system call when available, which properly respects symlink handling, or otherwise using a workaround with /proc/self/fd to avoid following symlinks during chmod operations.

Until the update is applied, avoid running untrusted code that performs chmod operations on files that could be replaced by symlinks in a race condition.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0