Description

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to gain unauthorized access to system objects due to a time-of-check to time-of-use (TOCTOU) race condition involving symbolic links.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.5",
  "pubDate": "2026-08-13T20:17:17.097Z",
  "pubdate": "2026-08-13T20:17:17.097Z",
  "executiveSummary": "A time-of-check to time-of-use (TOCTOU) race condition vulnerability exists in IBM i versions 7.6, 7.5, 7.4, and 7.3.\nThe vulnerability allows a remote authenticated attacker to bypass access controls and gain unauthorized access to critical system objects.\nThe flaw stems from improper handling of symbolic links during file system operations, creating a temporal window between the security validation phase and the execution phase.\nAn attacker with valid authentication can manipulate symbolic links within this window to target sensitive resources they would otherwise not be authorized to access.\nSuccessful exploitation compromises confidentiality and integrity constraints of the operating system by granting unauthorized object access.\nRemediation requires applying vendor-supplied security bulletins and patches specific to the affected IBM i releases.",
  "technicalDetails": "The vulnerability is fundamentally rooted in a time-of-check to time-of-use (TOCTOU) race condition within the file system management logic of IBM i 7.6, 7.5, 7.4, and 7.3.\nThe vulnerable component involves internal operating system routines that resolve and validate symbolic links during file access operations.\nExploitation requires the attacker to possess remote authentication and standard user privileges within the environment.\nThe attack flow proceeds in two distinct temporal phases: the check phase and the use phase.\nDuring the check phase, the operating system verifies user permissions against the target path referenced by a symbolic link to ensure the access request complies with security policies.\nDuring the brief execution window between this verification (time-of-check) and the actual file operation (time-of-use), a concurrent thread or process controlled by the attacker rapidly swaps the legitimate symbolic link with a reference to a restricted system object.\nBecause the permission validation has already successfully completed for the initial path, the system proceeds to execute the requested file operation against the newly substituted restricted object.\nThis race condition bypasses standard object-level authorization checks enforced by the security subsystem.\nPost-exploitation impact includes unauthorized read or write access to protected system objects, potentially leading to privilege escalation, data exposure, or system instability depending on the targeted resource."
}