6.4

CVE-2026-32282: TOCTOU permits root escape on Linux via Root.Chmod in os in internal/syscall/unix

Analyzed
AliasesRHSA-2026:25999RHSA-2026:27732UBUNTU-CVE-2026-32282
Published 08-04-2026Last modified 13-04-2026

Vulnerability summary

CVE-2026-32282 is a medium (CVSS 6.4) vulnerability in go standard library internal/syscall/unix. EPSS estimates a 0.29% chance of exploitation in the next 30 days, higher than 21.8% of scored vulnerabilities.

Priority
Routine

Not severe (CVSS 6.4, local access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?
CVSS score
6.4/10
010
Medium · v3.1 (CVE.org)
EPSS score
0.29%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 103 · Related 102
MGASA-2026-0143MGASA-2026-0147OPENSUSE-SU-2026:10514-1OPENSUSE-SU-2026:10525-1OPENSUSE-SU-2026:10673-1OPENSUSE-SU-2026:20570-1

Showing 100 of 104.

Timeline

  1. 08-04-2026
    PublishedVulnerability first disclosed.
  2. 13-04-2026
    Last modifiedVulnerability information updated.

Description

On Linux, if the target of Root.Chmod is replaced with a symlink while the chmod operation is in progress, Chmod can operate on the target of the symlink, even when the target lies outside the root. The Linux fchmodat syscall silently ignores the AT_SYMLINK_NOFOLLOW flag, which Root.Chmod uses to avoid symlink traversal. Root.Chmod checks its target before acting and returns an error if the target is a symlink lying outside the root, so the impact is limited to cases where the target is replaced with a symlink between the check and operation.

CVSS metrics

8 scores · 8 sources · 1 version

EPSS trend

Probability

0.29%

Chance of exploitation in the next 30 days

Percentile

22%

Versus all other CVEs

30-day change

No change 0.00 pp

From 0.29% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: local access, administrative account, no user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard198 products
  • aactl< 0.4.12-r53
  • actAll versions (No fix recorded)
  • actions-runner-controllerAll versions (No fix recorded)
  • actions-runner-controller-fipsAll versions (No fix recorded)
  • addon-resizerAll versions (No fix recorded)
Alpine2 products
  • go≥ 1.26.0, < 1.25.9-r0 | ≥ 1.26.0, < 1.26.2-r0
  • rclone< 1.73.5-r0

2 vendors · 200 products · Showing 200 of 3808

References

18 links
Show all 18 references