CVE-2026-86469: 
Linux Red Hat Analyse et atténuation des vulnérabilités

CVE-2026-86469 is a TOCTOU (Time-of-Check Time-of-Use) symlink race condition vulnerability in GLib2's g_file_replace() function. When the function is invoked with the G_FILE_CREATE_REPLACE_DESTINATION flag and the initial .goutputstream-XXXXXX temporary file creation fails, the library falls back to unlinking the destination and recreating it without exclusive creation (O_EXCL) or symlink protection. A local attacker with write access to the destination directory can exploit this race window to redirect file writes to an arbitrary target. Affected products include Red Hat's glib2, mingw-glib2, and related packages across Red Hat Enterprise Linux and OpenShift Container Platform variants. The vulnerability was reported by Aisle Research, disclosed on September 7, 2026, and carries a CVSS v3.1 base score of 5.3 (Medium) (Red Hat CVE, GitHub Advisory).

The root cause is classified as CWE-59 (Improper Link Resolution Before File Access / 'Link Following'). The vulnerability resides in handle_overwrite_open() within gio/glocalfileoutputstream.c. The normal code path creates a temporary file and atomically renames it to the destination; however, when g_mkstemp_full() fails (e.g., due to ENOSPC), the fallback path calls g_unlink(filename) followed by g_open(filename, O_CREAT | O_WRONLY, ...) — notably without O_EXCL or O_NOFOLLOW. An attacker who can write to the destination directory can race between the unlink and the reopen to place a symlink at the destination path, causing subsequent writes to land in the symlink's target file under the victim process's permissions. The proposed fix adds O_EXCL to the fallback open() call and returns an error if the file already exists at that path (Red Hat Bugzilla, Red Hat CVE).

A successful exploit allows an unprivileged local attacker to redirect file writes performed by a higher-privileged process, enabling overwrite or corruption of arbitrary files that the victim process is permitted to write. This results in a high integrity impact (arbitrary file content modification) and a low availability impact (potential file corruption causing service disruption), with no direct confidentiality impact. The scope is limited to the local system, but depending on which files are overwritten, exploitation could facilitate privilege escalation or persistent tampering with system or application data (Red Hat CVE, Red Hat Bugzilla).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the disclosure date. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access, the ability to write to the destination directory, the ability to trigger or coincide with a temporary file creation failure (a relatively uncommon fallback path), and successful timing of a narrow race condition — all of which significantly limit practical exploitability (Red Hat CVE, GitHub Advisory).

1. Gain local access: Obtain a low-privileged local account on a system running a vulnerable version of GLib2 with write access to a directory used as a destination for g_file_replace() calls by a higher-privileged process.
2. Force the fallback path: Use an LD_PRELOAD shim or other mechanism to cause open() or openat() calls for paths containing /.goutputstream- to fail with ENOSPC, deterministically driving g_mkstemp_full() to fail and triggering the vulnerable fallback in handle_overwrite_open().
3. Monitor for unlink: Watch the destination directory (e.g., using inotifywait) for the IN_DELETE event on the target filename, indicating that g_unlink() has been called.
4. Race in a symlink: Immediately upon detecting the unlink, create a symlink at the destination path pointing to the attacker's chosen target file (e.g., a configuration file or cron job writable by the victim process).
5. Observe redirected write: The victim process's subsequent g_open(filename, O_CREAT | O_WRONLY, ...) follows the symlink, and all data written to the GLib output stream is written into the symlink target, overwriting its contents with attacker-influenced data (Red Hat Bugzilla).

• File System: Unexpected symlinks appearing in directories used as destinations for privileged file replacement operations; files with modified timestamps or unexpected content in locations not directly written to by the victim process.
• Logs: Application or system logs showing ENOSPC errors or temporary file creation failures from GLib-based applications in directories that are not actually full; audit logs (auditd) recording symlink() or symlinkat() syscalls in sensitive directories immediately followed by open() calls from a different process.
• Process: Unusual LD_PRELOAD environment variables set for processes invoking GLib-based applications; unexpected child processes or scripts monitoring directory events (e.g., inotifywait) in sensitive directories (Red Hat Bugzilla, Red Hat CVE).

Red Hat's primary workaround is to avoid using g_file_replace(..., G_FILE_CREATE_REPLACE_DESTINATION, ...) on paths located in directories writable by less-privileged users. Additionally, privileged replacement writes should not be performed in shared writable directories where another user can recreate the destination pathname. Preventing temporary file creation failures (e.g., ensuring sufficient disk space and appropriate directory permissions) reduces reachability but should be treated as defense-in-depth only. A proposed upstream patch adds O_EXCL to the fallback open() call in gio/glocalfileoutputstream.c; users should monitor the GLib upstream repository and Red Hat errata for a released package fix (Red Hat CVE, Red Hat Bugzilla).

Red Hat credited Aisle Research with discovering and reporting the vulnerability. The Red Hat Product Security team classified the issue as Moderate severity, noting that while integrity impact is high, the local-only attack vector, uncommon fallback path dependency, and race condition requirement materially limit exploitability compared to higher-severity flaws. No significant broader community or media commentary has been identified at this time (Red Hat CVE).