CVE-2026-16552 in Red Hat
Summary
by MITRE • 07/22/2026
A flaw was found in systemd-tmpfiles. When processing a tmpfiles.d configuration entry that writes to a file, systemd-tmpfiles can follow a symbolic link placed by an unprivileged local user, and an existing safety check does not detect this specific case because it always treats transitions away from the root user as safe. On systems where a tmpfiles.d configuration targets a path an unprivileged user can influence, this could allow that user to redirect a privileged systemd-tmpfiles write to a file of their choosing, though the content written remains determined by the existing configuration rather than by the unprivileged user. The highest threat from this vulnerability is to integrity.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/22/2026
The vulnerability in systemd-tmpfiles represents a critical integrity risk within Linux system management frameworks that operates through a sophisticated symbolic link traversal mechanism. This flaw exists within the tmpfiles.d configuration processing subsystem which is responsible for managing temporary files and directories during system initialization and runtime operations. The vulnerability specifically targets the security checks implemented by systemd-tmpfiles when handling configuration entries that write to files, creating an exploitable condition where unprivileged users can manipulate privileged file operations through carefully crafted symbolic link placement.
The technical implementation of this vulnerability stems from a flawed safety mechanism that incorrectly assumes all transitions away from root user context are inherently safe. This assumption fails to account for the specific scenario where an unprivileged user places a symbolic link at a location targeted by a privileged tmpfiles.d configuration entry. The existing validation logic only considers the user ID of the current process but ignores the fact that the target path may be under the influence of an unprivileged user who could have manipulated the symbolic link resolution path. This oversight creates a privilege escalation vector through file integrity manipulation rather than direct privilege elevation.
From an operational impact perspective, this vulnerability allows attackers to redirect writes from intended privileged locations to arbitrary files chosen by the unprivileged user while maintaining control over what content gets written. The attack requires that the targeted tmpfiles.d configuration entry points to a location where the attacker can influence symbolic link placement, which is typically found in world-writable directories or areas where users have write permissions. This creates a scenario where system administrators' security configurations can be subverted without requiring elevated privileges, potentially allowing attackers to modify critical system files, log files, or configuration data that would normally only be accessible to privileged processes.
The threat model for this vulnerability aligns with CWE-59 and CWE-22 categories, specifically addressing weaknesses in path traversal and symbolic link handling within system management tools. This corresponds to ATT&CK technique T1068 which covers privilege escalation through local exploitation of system services, and T1566 which addresses social engineering via manipulation of file systems. The vulnerability demonstrates how seemingly benign configuration management processes can become attack vectors when proper input validation and path resolution checks are insufficiently implemented.
Mitigation strategies should focus on implementing stricter symbolic link validation within systemd-tmpfiles processing, ensuring that all path traversals are verified against the actual target filesystem rather than relying solely on user context transitions. System administrators should audit tmpfiles.d configuration entries to identify those pointing to potentially compromised locations and consider implementing additional security controls such as file system access controls, mandatory access controls through SELinux or AppArmor, and regular monitoring of symbolic link creation in sensitive directories. Updates to systemd packages that address this specific validation flaw should be prioritized, along with comprehensive testing of tmpfiles.d configurations to ensure no vulnerable entries exist within the system landscape.