CVE-2026-32282: 
Go vulnerability analysis and mitigation

CVE-2026-32282 is a TOCTOU (Time-of-Check Time-of-Use) race condition vulnerability in Go's standard library os package affecting the Root.Chmod function on Linux. When the target of Root.Chmod is replaced with a symbolic link while the chmod operation is in progress, the function can operate on the symlink's target even if it lies outside the intended root directory. This occurs because the Linux fchmodat syscall silently ignores the AT_SYMLINK_NOFOLLOW flag that Root.Chmod relies on to prevent symlink traversal. Affected versions are Go 1.25.x before 1.25.9 and Go 1.26.x before 1.26.2. It carries a CVSS v3.1 base score of 6.4 (Medium) (GitHub Advisory, pkg.go.dev).

The root cause is classified as CWE-59 (Improper Link Resolution Before File Access / 'Link Following'), specifically a TOCTOU race condition in Go's internal/syscall/unix package. Root.Chmod performs a pre-check to verify the target is not a symlink pointing outside the root, then proceeds with the chmod operation — but the Linux kernel's fchmodat syscall ignores the AT_SYMLINK_NOFOLLOW flag, meaning if an attacker replaces the target with a symlink between the check and the syscall execution, the operation proceeds on the symlink's destination. Exploitation requires high privileges and precise timing to win the race window between the check and the operation, making it a high-complexity attack (GitHub Advisory, go.dev issue).

Successful exploitation could allow a high-privileged attacker to modify file permissions on files outside the intended root directory, potentially enabling privilege escalation or unauthorized file access. The confidentiality, integrity, and availability impacts are all rated High, as arbitrary permission changes on sensitive system files could expose data, corrupt system state, or disrupt availability. The attack scope is limited to the local system and requires the attacker to already hold high privileges, constraining the practical blast radius (GitHub Advisory, pkg.go.dev).

No public proof-of-concept exploit code is known to exist, and there is no evidence of active in-the-wild exploitation as of the time of disclosure (GitHub Advisory). The EPSS score is approximately 0.01% (1st percentile), reflecting a very low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is further constrained by the requirement for high privileges and precise race condition timing (pkg.go.dev).

1. Prerequisite: Obtain high-privileged access on a Linux system running a Go application that uses Root.Chmod from the os package (Go 1.25.x < 1.25.9 or 1.26.x < 1.26.2).
2. Identify target: Locate a file path within the root directory that the vulnerable application will call Root.Chmod on.
3. Race setup: Prepare a symlink pointing to a sensitive file outside the intended root (e.g., /etc/shadow or a privileged binary).
4. Trigger race: Repeatedly invoke the application's Root.Chmod operation while simultaneously replacing the target file with the prepared symlink in a tight loop, attempting to win the window between the pre-check and the fchmodat syscall.
5. Achieve impact: If the race is won, fchmodat operates on the symlink's target outside the root, changing its permissions — potentially making a sensitive file world-readable or a binary executable by unprivileged users, enabling further privilege escalation (GitHub Advisory, go.dev issue).

• File System: Unexpected permission changes on sensitive files outside the application's intended root directory (e.g., /etc/shadow, privileged binaries, or configuration files with altered mode bits).
• File System: Presence of newly created symbolic links within directories accessible to the Go application, pointing to files outside the root.
• Logs: Application or audit logs showing chmod-related operations on paths that resolve outside the expected root directory.
• Process: High-frequency file replacement activity (rapid creation/deletion of symlinks) in directories monitored by the vulnerable Go process, potentially visible via inotify or auditd events.
• Audit: Linux auditd records showing fchmodat syscalls with unexpected target paths resolving outside the application root.

Update Go to version 1.25.9 or later (for the 1.25.x branch) or 1.26.2 or later (for the 1.26.x branch). The fix is available via the Go change list at go.dev/cl/763761. No configuration-based workaround is available since the underlying issue is a kernel behavior (Linux fchmodat ignoring AT_SYMLINK_NOFOLLOW); upgrading Go is the only reliable remediation. Prioritize patching systems where high-privileged Go processes perform Root.Chmod operations on Linux (go.dev CL, pkg.go.dev, GitHub Advisory).

The Go team disclosed the vulnerability via the golang-announce mailing list and published a fix promptly (golang-announce). Downstream Linux distributions including Red Hat, openSUSE, Oracle Linux, AlmaLinux, Amazon Linux, and SUSE have issued security advisories and updated packages incorporating the patched Go versions. The vulnerability received routine coverage from Linux security news aggregators and scanner vendors (Tenable Nessus, Qualys), with no notable controversy or significant social media amplification given its high-complexity, high-privilege exploitation requirements.