CVE-2026-16552
Awaiting Analysis Awaiting Analysis - Queue

Symbolic Link Following in systemd-tmpfiles

Publication date: 2026-07-22

Last updated on: 2026-07-22

Assigner: Red Hat, Inc.

Description
A flaw was found in systemd-tmpfiles. When processing a tmpfiles.d configuration entry that writes to a file, systemd-tmpfiles can follow a symbolic link placed by an unprivileged local user, and an existing safety check does not detect this specific case because it always treats transitions away from the root user as safe. On systems where a tmpfiles.d configuration targets a path an unprivileged user can influence, this could allow that user to redirect a privileged systemd-tmpfiles write to a file of their choosing, though the content written remains determined by the existing configuration rather than by the unprivileged user. The highest threat from this vulnerability is to integrity.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-22
Last Modified
2026-07-22
Generated
2026-07-22
AI Q&A
2026-07-22
EPSS Evaluated
N/A
NVD
CVE-2026-16552
EUVD
EUVD-2026-47736

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
systemd systemd From 7 (inc) to 10 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-59 The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in systemd-tmpfiles allows an unprivileged local user to overwrite root-owned files by exploiting a symlink redirection attack. The flaw occurs when systemd-tmpfiles processes a tmpfiles.d configuration entry that writes to a file. The safety check fails to detect unsafe transitions from root to unprivileged users, enabling the attacker to place a symlink in their directory pointing to a root-owned file. When systemd-tmpfiles runs as root, it follows the symlink and overwrites the target file with predefined content.

Detection Guidance

Check for tmpfiles.d configurations targeting user-writable paths by inspecting files in /etc/tmpfiles.d/ and /usr/lib/tmpfiles.d/. Look for entries with 'w' type that write to files in directories like /run/user/<uid> or /tmp. Verify if systemd-tmpfiles follows symlinks during execution by monitoring file writes with tools like strace or auditd.

Impact Analysis

This vulnerability could allow an attacker to overwrite critical system files, potentially leading to system instability, privilege escalation, or unauthorized modifications. Since the attacker controls the destination file but not the content, the impact is primarily on file integrity. Systems using tmpfiles.d configurations targeting user-writable paths are most at risk.

Mitigation Strategies

Update systemd to the latest patched version. Review and restrict tmpfiles.d configurations to avoid writing to user-controllable paths. Temporarily disable tmpfiles.d entries that use 'w' type for sensitive directories until patched. Monitor system logs for unexpected file writes by systemd-tmpfiles.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-16552. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart