CLSA-2026-1789745909
See a problem?- Import Source
- https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1789745909.json
- JSON Data
- https://api.osv.dev/v1/vulns/CLSA-2026-1789745909
- Upstream
CVE (2)
- Published
- 2026-09-18T15:38:40Z
- Modified
- 2026-10-26T09:43:51Z
- Summary
- Fix CVE(s): CVE-2026-53785
- Details
-
- SECURITY UPDATE: Destination-tree escape via symlink following in
--relative implied-parent handling
- debian/patches/CVE-2026-53785.patch: resolve the receiver's destination names one component at a time with O_NOFOLLOW|O_DIRECTORY, acting against a directory fd that is held open, instead of handing the whole name to the kernel to resolve; a component that is a symlink is now refused rather than traversed, so nothing the receiver creates lands at the symlink's target outside the destination tree; adds secure_relative_dirfd(), do_mkdir_at(), do_stat_at(), do_open_at(), do_rename_at(), do_symlink_at(), do_mknod_at() and do_link_at() in syscall.c and routes every way the receiver creates something at a destination name through them -- make_path() in util.c, the four implied-parent sites in generator.c, the install-into-final-name renames in util.c, rsync.c, receiver.c and generator.c, copy_file()'s reopen of the destination on the cross-filesystem fallback, the symlink and mknod creations in generator.c's atomic_create(), and the --link-dest and -H hard links in generator.c and hlink.c; each of those is its own route to the destination name, reached by a different option (--temp-dir bypasses the file create entirely, --devices / --specials and a transferred symlink never touch it, and --link-dest installs a regular file's link from hlink.c but a non-regular file's from generator.c), so confining only some of them leaves the escape open; extends the existing secure_mkstemp() and secure_relative_open() receiver create paths, which the CVE-2026-29518 fix gated on daemon-no-chroot only, to the same confinement; the confinement covers a chrooted daemon serving an inner-module "/./" boundary, whose module root the kernel chroot does not confine, and exempts --keep-dirlinks only for a local receiver, whose documented purpose is to follow a symlinked destination directory -- never for a daemon or for the server side of a push, where the option arrives from the peer; only the confinement this CVE needs is carried, not upstream's whole-tree dirfd-stack resolver, which assumes a source layout this version does not have; defines am_daemon, am_chrooted, am_server, local_server and keep_dirlinks in t_stub.c, which the standalone test harnesses link in place of options.c and main.c, so debian/rules' check target still builds; and adds testsuite/cve-2026-53785.test
- CVE-2026-53785
- SECURITY UPDATE: Destination-tree escape via symlink following in
--relative implied-parent handling
- References