Repository navigation
os: Root.Chmod can follow symlinks out of the root on Linux #78293
Description
On Linux, if the target of Root.Chmod is replaced with a symlink while
the chmod operation is in progress, Chmod could operate on the target
of the symlink, even when the target lies outside the root.
The Linux fchmodat syscall silently ignores the AT_SYMLINK_NOFOLLOW flag,
which Root.Chmod uses to avoid symlink traversal. Root.Chmod checks its
target before acting and returns an error if the target is a symlink
lying outside the root, so the impact is limited to cases where the
target is replaced with a symlink between the check and operation.
On Linux, Root.Chmod now uses the fchmodat2 syscall when available, and
an workaround using /proc/self/fd otherwise.
Thanks to Uuganbayar Lkhamsuren for reporting this issue.
This is CVE-2026-32282 and Go issue #78293.
This is a PRIVATE issue for CVE-2026-32282, tracked in http://b/493187489 and fixed by https://go-internal-review.git.corp.google.com/c/go/+/3900.
cc @golang/security and @golang/release
Activity
neild commentedon Mar 27, 2026
@gopherbot please open backport issues for this security fix
gopherbot commentedon Mar 27, 2026
Backport issue(s) opened: #78425 (for 1.25), #78426 (for 1.26).
Remember to create the cherry-pick CL(s) as soon as the patch is submitted to master, according to https://go.dev/wiki/MinorReleases.
gopherbot commentedon Apr 7, 2026
Change https://go.dev/cl/763542 mentions this issue:
[release-branch.go1.26] internal/syscall/unix: properly support AT_SYMLINK_NOFOLLOW on Linuxgopherbot commentedon Apr 7, 2026
Change https://go.dev/cl/763550 mentions this issue:
[release-branch.go1.25] internal/syscall/unix: properly support AT_SYMLINK_NOFOLLOW on Linux[release-branch.go1.25] internal/syscall/unix: properly support AT_SY…
[release-branch.go1.26] internal/syscall/unix: properly support AT_SY…
[-]security: fix CVE-2026-32282[/-][+]crypto/x509: incorrect enforcement of email constraints[/+][-]crypto/x509: incorrect enforcement of email constraints[/-][+]os: Root.Chmod can follow symlinks out of the root on Linux[/+]gopherbot commentedon Apr 7, 2026
Change https://go.dev/cl/763761 mentions this issue:
internal/syscall/unix: properly support AT_SYMLINK_NOFOLLOW on Linuxlzap commentedon May 11, 2026
Do I understand this correctly that the only affected versions are 1.25/1.26? Thanks.