# CVE-2026-54371: attr: The attr packages provide extended attributes, which can be used to store system objects like capabilities of executa... CVE-2026-54371 is fixed in 8 products on 1 platform, first by attr 1:2.4.47-2ubuntu0.18.04.1~esm1, released June 29, 2026. It is not reported as exploited. Patch Radar priority: Routine. - Web page: https://patchblox.com/security/cve/CVE-2026-54371 - Priority: Routine - CVSS: 6.3 (Moderate) - EPSS: 0.0015 - CISA KEV: not listed - Exploited (vendor report): no - Publicly disclosed: no - Published: Jun 29, 2026 ## Description The attr packages provide extended attributes, which can be used to store system objects like capabilities of executables and access control lists, as well as user objects. Security Fix(es): * attr: Symlink Traversal Privilege Escalation via getfattr and setfattr (CVE-2026-54371) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. ## Where it's fixed | Platform | Product | Fixed in | Fix | Released | |---|---|---|---|---| | Linux | acl opensuse-leap 16.0 | 2.4.0-160000.1.1 | [OPENSUSE-SU-2026:21832-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-21832-1.md) | Sep 11, 2026 | | Linux | acl sles 15.6 | 2.4.0-150000.4.6.1 | [SUSE-SU-2026:4176-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-4176-1.md) | Sep 14, 2026 | | Linux | acl sles 15.7 | 2.4.0-150000.4.6.1 | [SUSE-SU-2026:4176-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-4176-1.md) | Sep 14, 2026 | | Linux | acl sles 16.0 | 2.4.0-160000.1.1 | [SUSE-SU-2026:23726-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-23726-1.md) | Sep 11, 2026 | | Linux | attr Debian 14 | 1:2.6.0-1 | [DEBIAN-CVE-2026-54371](https://patchblox.com/security/data/fix/linux/debian-cve-2026-54371.md) | Jul 2, 2026 | | Linux | attr Fedora 43 | 2.6.0-1.fc43 | [FEDORA-2026-B85570F8E4](https://patchblox.com/security/data/fix/linux/fedora-2026-b85570f8e4.md) | Jul 9, 2026 | | Linux | attr RHEL 10 | 2.6.0-1.el10_2 | [RHSA-2026:59380](https://patchblox.com/security/data/fix/linux/rhsa-2026-59380.md) | Jun 29, 2026 | | Linux | attr RHEL 8 | 0:2.6.0-1.el8_10 | [RHSA-2026:56133](https://patchblox.com/security/data/fix/linux/rhsa-2026-56133.md) | Aug 19, 2026 | | Linux | attr RHEL 9 | 0:2.6.0-1.el9_8 | [RHSA-2026:60226](https://patchblox.com/security/data/fix/linux/rhsa-2026-60226.md) | Aug 28, 2026 | | Linux | attr Ubuntu 18.04.6 LTS (bionic) | 1:2.4.47-2ubuntu0.18.04.1~esm1 | [attr 1:2.4.47-2ubuntu0.18.04.1~esm1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-attr-1-2.4.47-2ubuntu0.18.04.1-esm1.md) | Jun 29, 2026 | | Linux | attr Ubuntu 20.04 LTS (focal) | 1:2.4.48-5ubuntu0.1~esm1 | [attr 1:2.4.48-5ubuntu0.1~esm1](https://patchblox.com/security/data/fix/linux/ubuntu-focal-attr-1-2.4.48-5ubuntu0.1-esm1.md) | Jun 29, 2026 | | Linux | attr Ubuntu 22.04.1 LTS (jammy) | 1:2.5.1-1ubuntu0.1 | [attr 1:2.5.1-1ubuntu0.1](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-attr-1-2.5.1-1ubuntu0.1.md) | Jun 29, 2026 | | Linux | attr Ubuntu 24.04.5 LTS (noble) | 1:2.5.2-1ubuntu0.1 | [attr 1:2.5.2-1ubuntu0.1](https://patchblox.com/security/data/fix/linux/ubuntu-noble-attr-1-2.5.2-1ubuntu0.1.md) | Jun 29, 2026 | | Linux | attr Ubuntu 26.04.1 LTS (resolute) | 1:2.5.2-4ubuntu0.1 | [attr 1:2.5.2-4ubuntu0.1](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-attr-1-2.5.2-4ubuntu0.1.md) | Jun 29, 2026 | | Linux | attr almalinux 10 | 2.6.0-1.el10_2 | [ALSA-2026:59380](https://patchblox.com/security/data/fix/linux/alsa-2026-59380.md) | Aug 25, 2026 | | Linux | attr almalinux 8 | 2.6.0-1.el8_10 | [ALSA-2026:56133](https://patchblox.com/security/data/fix/linux/alsa-2026-56133.md) | Aug 18, 2026 | | Linux | attr almalinux 9 | 2.6.0-1.el9_8 | [ALSA-2026:60226](https://patchblox.com/security/data/fix/linux/alsa-2026-60226.md) | Aug 26, 2026 | | Linux | attr ol 10 | 0:2.6.0-1.el10_2 | [ELSA-2026-59380](https://patchblox.com/security/data/fix/linux/elsa-2026-59380.md) | Aug 25, 2026 | | Linux | attr ol 8 | 0:2.6.0-1.el8_10 | [ELSA-2026-56133](https://patchblox.com/security/data/fix/linux/elsa-2026-56133.md) | Aug 18, 2026 | | Linux | attr ol 9 | 0:2.6.0-1.el9_8 | [ELSA-2026-60226-0](https://patchblox.com/security/data/fix/linux/elsa-2026-60226-0.md) | Aug 26, 2026 | | Linux | attr opensuse-leap 16.0 | 2.6.0-160000.1.1 | [OPENSUSE-SU-2026:21832-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-21832-1.md) | Sep 11, 2026 | | Linux | attr rocky 10 | 0:2.6.0-1.el10_2 | [RLSA-2026:59380](https://patchblox.com/security/data/fix/linux/rlsa-2026-59380.md) | Aug 26, 2026 | | Linux | attr rocky 8 | 0:2.6.0-1.el8_10 | [RLSA-2026:56133](https://patchblox.com/security/data/fix/linux/rlsa-2026-56133.md) | Aug 19, 2026 | | Linux | attr rocky 9 | 0:2.6.0-1.el9_8 | [RLSA-2026:60226](https://patchblox.com/security/data/fix/linux/rlsa-2026-60226.md) | Aug 27, 2026 | | Linux | attr sles 15.6 | 2.6.0-150000.4.3.1 | [SUSE-SU-2026:4176-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-4176-1.md) | Sep 14, 2026 | | Linux | attr sles 15.7 | 2.6.0-150000.4.3.1 | [SUSE-SU-2026:4176-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-4176-1.md) | Sep 14, 2026 | | Linux | attr sles 16.0 | 2.6.0-160000.1.1 | [SUSE-SU-2026:23726-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-23726-1.md) | Sep 11, 2026 | | Linux | attr-debuginfo Fedora 43 | 2.6.0-1.fc43 | [FEDORA-2026-B85570F8E4](https://patchblox.com/security/data/fix/linux/fedora-2026-b85570f8e4.md) | Jul 9, 2026 | | Linux | attr-debugsource Fedora 43 | 2.6.0-1.fc43 | [FEDORA-2026-B85570F8E4](https://patchblox.com/security/data/fix/linux/fedora-2026-b85570f8e4.md) | Jul 9, 2026 | | Linux | libattr Fedora 43 | 2.6.0-1.fc43 | [FEDORA-2026-B85570F8E4](https://patchblox.com/security/data/fix/linux/fedora-2026-b85570f8e4.md) | Jul 9, 2026 | | Linux | libattr RHEL 8 | 0:2.6.0-1.el8_10 | [RHSA-2026:56133](https://patchblox.com/security/data/fix/linux/rhsa-2026-56133.md) | Aug 19, 2026 | | Linux | libattr RHEL 9 | 0:2.6.0-1.el9_8 | [RHSA-2026:60226](https://patchblox.com/security/data/fix/linux/rhsa-2026-60226.md) | Aug 28, 2026 | | Linux | libattr almalinux 10 | 2.6.0-1.el10_2 | [ALSA-2026:59380](https://patchblox.com/security/data/fix/linux/alsa-2026-59380.md) | Aug 25, 2026 | | Linux | libattr almalinux 8 | 2.6.0-1.el8_10 | [ALSA-2026:56133](https://patchblox.com/security/data/fix/linux/alsa-2026-56133.md) | Aug 18, 2026 | | Linux | libattr almalinux 9 | 2.6.0-1.el9_8 | [ALSA-2026:60226](https://patchblox.com/security/data/fix/linux/alsa-2026-60226.md) | Aug 26, 2026 | | Linux | libattr ol 10 | 0:2.6.0-1.el10_2 | [ELSA-2026-59380](https://patchblox.com/security/data/fix/linux/elsa-2026-59380.md) | Aug 25, 2026 | | Linux | libattr ol 8 | 0:2.6.0-1.el8_10 | [ELSA-2026-56133](https://patchblox.com/security/data/fix/linux/elsa-2026-56133.md) | Aug 18, 2026 | | Linux | libattr ol 9 | 0:2.6.0-1.el9_8 | [ELSA-2026-60226-0](https://patchblox.com/security/data/fix/linux/elsa-2026-60226-0.md) | Aug 26, 2026 | | Linux | libattr-debuginfo Fedora 43 | 2.6.0-1.fc43 | [FEDORA-2026-B85570F8E4](https://patchblox.com/security/data/fix/linux/fedora-2026-b85570f8e4.md) | Jul 9, 2026 | | Linux | libattr-devel Fedora 43 | 2.6.0-1.fc43 | [FEDORA-2026-B85570F8E4](https://patchblox.com/security/data/fix/linux/fedora-2026-b85570f8e4.md) | Jul 9, 2026 | | Linux | libattr-devel RHEL 8 | 0:2.6.0-1.el8_10 | [RHSA-2026:56133](https://patchblox.com/security/data/fix/linux/rhsa-2026-56133.md) | Aug 19, 2026 | | Linux | libattr-devel RHEL 9 | 0:2.6.0-1.el9_8 | [RHSA-2026:60226](https://patchblox.com/security/data/fix/linux/rhsa-2026-60226.md) | Aug 28, 2026 | | Linux | libattr-devel almalinux 10 | 2.6.0-1.el10_2 | [ALSA-2026:59380](https://patchblox.com/security/data/fix/linux/alsa-2026-59380.md) | Aug 25, 2026 | | Linux | libattr-devel almalinux 8 | 2.6.0-1.el8_10 | [ALSA-2026:56133](https://patchblox.com/security/data/fix/linux/alsa-2026-56133.md) | Aug 18, 2026 | | Linux | libattr-devel almalinux 9 | 2.6.0-1.el9_8 | [ALSA-2026:60226](https://patchblox.com/security/data/fix/linux/alsa-2026-60226.md) | Aug 26, 2026 | | Linux | libattr-devel ol 10 | 0:2.6.0-1.el10_2 | [ELSA-2026-59380](https://patchblox.com/security/data/fix/linux/elsa-2026-59380.md) | Aug 25, 2026 | | Linux | libattr-devel ol 8 | 0:2.6.0-1.el8_10 | [ELSA-2026-56133](https://patchblox.com/security/data/fix/linux/elsa-2026-56133.md) | Aug 18, 2026 | | Linux | libattr-devel ol 9 | 0:2.6.0-1.el9_8 | [ELSA-2026-60226-0](https://patchblox.com/security/data/fix/linux/elsa-2026-60226-0.md) | Aug 26, 2026 | | Linux | libattr1 Ubuntu 18.04.6 LTS (bionic) | 1:2.4.47-2ubuntu0.18.04.1~esm1 | [libattr1 1:2.4.47-2ubuntu0.18.04.1~esm1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-libattr1-1-2.4.47-2ubuntu0.18.04.1-esm1.md) | Jun 29, 2026 | | Linux | libattr1 Ubuntu 20.04 LTS (focal) | 1:2.4.48-5ubuntu0.1~esm1 | [libattr1 1:2.4.48-5ubuntu0.1~esm1](https://patchblox.com/security/data/fix/linux/ubuntu-focal-libattr1-1-2.4.48-5ubuntu0.1-esm1.md) | Jun 29, 2026 | | Linux | libattr1 Ubuntu 22.04.1 LTS (jammy) | 1:2.5.1-1ubuntu0.1 | [libattr1 1:2.5.1-1ubuntu0.1](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-libattr1-1-2.5.1-1ubuntu0.1.md) | Jun 29, 2026 | | Linux | libattr1 Ubuntu 24.04.5 LTS (noble) | 1:2.5.2-1ubuntu0.1 | [libattr1 1:2.5.2-1ubuntu0.1](https://patchblox.com/security/data/fix/linux/ubuntu-noble-libattr1-1-2.5.2-1ubuntu0.1.md) | Jun 29, 2026 | | Linux | libattr1 Ubuntu 26.04.1 LTS (resolute) | 1:2.5.2-4ubuntu0.1 | [libattr1 1:2.5.2-4ubuntu0.1](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-libattr1-1-2.5.2-4ubuntu0.1.md) | Jun 29, 2026 | --- Data as of 2026-11-09T01:18:40Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.