AIKIDO-2026-198533

TL;DR

The recursive descent used by chown -R and chgrp -R lives in the shared uucore permissions walker, which stats each entry without following symlinks but then reopens each subdirectory in follow mode without re-verifying the opened descriptor. A local user who can write inside the processed tree can replace a real subdirectory with a symlink between the check and the descent open, so the walk resolves outside the intended tree. When a privileged process runs a recursive ownership change over such a tree, ownership of files outside it can be reassigned and used for privilege escalation. The fix opens descent directories with O_NOFOLLOW unless following is explicitly requested, so a swapped-in symlink makes the open fail instead of redirecting the walk.