Skip to content

GHSA-gg3m-4m9m-268h on CTRL-OS 26.05

Aliases: GHSA-gg3m-4m9m-268h, CVE-2026-70458

Packages: rsync

Status: Plausible

Advisory Information

A malicious peer marks a file entry FLAG_HLINKED even though hard links were not negotiated (-H absent), which the receiver accepted. (Accepting the flag on a DIRECTORY entry was a second invalid form closed by the same fix; the demonstrated write is on a regular file.) The HLINK_BUMP()/OPT_EXTRA offset computed for such an entry then places attacker-supplied bytes just outside the pool entry that was allocated for it.

Reaching the write requires protocol-30 incremental recursion, a regular file, --checksum in use, and -H absent: the extra hard-link slots are reserved only when preserve_hard_links is set, and the out-of-bounds write lands through F_SUM(file).

Fixed by refusing FLAG_HLINKED when hard links are not in use and refusing it on a directory entry.

Affected: 3.0.0 through 3.4.4

Fixed in: 3.5.0 (part of the malicious-peer robustness work)

Reporter: Greg Kroah-Hartman (daemon-protocol fuzzing)

Test: proto-hlink-flag-oob

Updates

2026-08-14 16:57 CEST

Metadata changes:

  • Status for package rsync: “Plausible”

2026-08-14 16:55 CEST

Metadata changes:

  • Status for package rsync: “New”