A flaw was found in systemd-tmpfiles. When processing a tmpfiles.d configuration entry that writes to a file, systemd-tmpfiles can follow a symbolic link placed by an unprivileged local user, and an existing safety check does not detect this specific case because it always treats transitions away from the root user as safe. On systems where a tmpfiles.d configuration targets a path an unprivileged user can influence, this could allow that user to redirect a privileged systemd-tmpfiles write to a file of their choosing, though the content written remains determined by the existing configuration rather than by the unprivileged user. The highest threat from this vulnerability is to integrity.
This CVE has been withdrawn by MITRE
MITRE marked CVE-2026-16552 as REJECTED on . It is no longer considered a valid vulnerability record. The original content below is preserved for historical reference only.
Reason given by MITRE
The reported issue is invalid, as it requires root privileges to reproduce, and it is out of scope of the threat model of the affected component.
CVE-2026-16552
✕ Withdrawn — historical dataMEDIUMPre-NVD 6.3
6.3CVSS
- CVSS v3
- 6.3
- EchelonGraph score
- Not yet assessedThis CVE record was withdrawn by its numbering authority, so there is no vulnerability to rate.
- EPSS PROB
- —
- EPSS %ILE
- —
- KEV
- —Not applicable: this CVE ID was withdrawn
Published
July 22, 2026
Last Modified
July 22, 2026
References (4)
- secalert@redhathttps://access.redhat.com/security/cve/CVE-2026-16552
- secalert@redhathttps://bugzilla.redhat.com/show_bug.cgi?id=2506073
- secalert@redhathttps://github.com/systemd/systemd/blob/b9ef5951f8f9e156479494fdb9ca6274cb3d3c53/src/basic/chase.c
- secalert@redhathttps://github.com/systemd/systemd/blob/b9ef5951f8f9e156479494fdb9ca6274cb3d3c53/src/tmpfiles/tmpfiles.c
Frequently asked(4)
What is CVE-2026-16552?
CVE-2026-16552 is a rejected CVE ID: its record was withdrawn on July 23, 2026 and no longer describes a vulnerability. Reason given: The reported issue is invalid, as it requires root privileges to reproduce, and it is out of scope of the threat model of the affected component.
When was the CVE record for CVE-2026-16552 published?
The CVE record for CVE-2026-16552 was published on July 22, 2026. EchelonGraph's copy of the record carries a last-modified date of July 22, 2026; the record at its source may have been updated since.
What is the CVSS score of CVE-2026-16552?
CVE-2026-16552 has a CVSS base score of 6.3 (a secondary CVSS source that NVD displays; NVD's own analysis pending).
How do I remediate CVE-2026-16552?
There is nothing to remediate under CVE-2026-16552: it is a rejected (withdrawn) CVE ID and no longer describes a vulnerability.