The reported issue is invalid, as it requires root privileges to reproduce, and it is out of scope of the threat model of the affected component.

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

No data.

No data.

No data.

Project Subscriptions

No data.

Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://github.com/systemd/systemd/blob/b9ef5951f8f9e156479494fdb9ca6274cb3d3c53/src/basic/chase.c cve-icon
https://github.com/systemd/systemd/blob/b9ef5951f8f9e156479494fdb9ca6274cb3d3c53/src/tmpfiles/tmpfiles.c cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2026-16552 cve-icon
https://www.cve.org/CVERecord?id=CVE-2026-16552 cve-icon
History

Thu, 23 Jul 2026 12:15:00 +0000

Type Values Removed Values Added
Title systemd: systemd-tmpfiles symlink-redirected arbitrary file overwrite via a CHASE_SAFE root-to-unprivileged ownership transition bypass
Weaknesses CWE-59
References
Metrics threat_severity

None

 cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H'}

threat_severity

Moderate

Thu, 23 Jul 2026 11:30:00 +0000

Type Values Removed Values Added
Title Systemd: systemd-tmpfiles symlink-redirected arbitrary file overwrite via a chase_safe root-to-unprivileged ownership transition bypass
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 23 Jul 2026 11:00:00 +0000

Type Values Removed Values Added
Description A flaw was found in systemd-tmpfiles. When processing a tmpfiles.d configuration entry that writes to a file, systemd-tmpfiles can follow a symbolic link placed by an unprivileged local user, and an existing safety check does not detect this specific case because it always treats transitions away from the root user as safe. On systems where a tmpfiles.d configuration targets a path an unprivileged user can influence, this could allow that user to redirect a privileged systemd-tmpfiles write to a file of their choosing, though the content written remains determined by the existing configuration rather than by the unprivileged user. The highest threat from this vulnerability is to integrity. The reported issue is invalid, as it requires root privileges to reproduce, and it is out of scope of the threat model of the affected component.
Weaknesses CWE-59
CPEs cpe:/a:redhat:hummingbird:1
cpe:/a:redhat:openshift:4
cpe:/o:redhat:enterprise_linux:10
cpe:/o:redhat:enterprise_linux:7
cpe:/o:redhat:enterprise_linux:8
cpe:/o:redhat:enterprise_linux:9
Vendors & Products Redhat
Redhat enterprise Linux
Redhat hummingbird
Redhat openshift
References
Metrics cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H'}

Wed, 22 Jul 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 22 Jul 2026 16:00:00 +0000

Type Values Removed Values Added
Description A flaw was found in systemd-tmpfiles. When processing a tmpfiles.d configuration entry that writes to a file, systemd-tmpfiles can follow a symbolic link placed by an unprivileged local user, and an existing safety check does not detect this specific case because it always treats transitions away from the root user as safe. On systems where a tmpfiles.d configuration targets a path an unprivileged user can influence, this could allow that user to redirect a privileged systemd-tmpfiles write to a file of their choosing, though the content written remains determined by the existing configuration rather than by the unprivileged user. The highest threat from this vulnerability is to integrity.
Title Systemd: systemd-tmpfiles symlink-redirected arbitrary file overwrite via a chase_safe root-to-unprivileged ownership transition bypass
First Time appeared Redhat
Redhat enterprise Linux
Redhat hummingbird
Redhat openshift
Weaknesses CWE-59
CPEs cpe:/a:redhat:hummingbird:1
cpe:/a:redhat:openshift:4
cpe:/o:redhat:enterprise_linux:10
cpe:/o:redhat:enterprise_linux:7
cpe:/o:redhat:enterprise_linux:8
cpe:/o:redhat:enterprise_linux:9
Vendors & Products Redhat
Redhat enterprise Linux
Redhat hummingbird
Redhat openshift
References
Metrics cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H'}

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: REJECTED

Assigner: redhat

Published:

Updated: 2026-07-23T10:24:24.056Z

Reserved: 2026-07-22T11:11:01.973Z

Link: CVE-2026-16552

cve-icon Vulnrichment

Updated:

cve-icon NVD

No data.

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-07-22T00:00:00Z

Links: CVE-2026-16552 - Bugzilla

cve-icon OpenCVE Enrichment

No data.

Weaknesses