Log in Start free

Vulnerability · Published Oct 14, 2026 · Assigned by redhat

CVE-2026-90954Busybox: busybox: dpkg-deb extraction-root escape via per-ar-member deferred symlink flush

High 7.8

In plain English

A high-severity security flaw in Red Hat Hardened Images from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities).

Severity (CVSS 3.1)7.8High
Exploit odds (30 days)0.2%top 85.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A flaw was found in BusyBox's dpkg-deb archive extraction. The ar archive handler flushes deferred symlinks after each archive member, unlike the tar, cpio, and unzip handlers which flush once after the last member. A specially crafted .deb archive with two data.tar members can exploit this ordering: the first member declares a symlink pointing to an absolute path (e.g., '/'), which is deferred as unsafe but flushed after the first member. The second member declares a regular file whose path traverses the now-live symlink, resulting in a file being written outside the intended extraction directory. This could allow an attacker to write arbitrary files to arbitrary locations when a user extracts a crafted .deb package.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12busyboxno fix listedDEBIAN-CVE-2026-90954
Debian:13busyboxno fix listedDEBIAN-CVE-2026-90954
Debian:14busyboxno fix listedDEBIAN-CVE-2026-90954
Ubuntu:22.04:LTSbusyboxno fix listedUBUNTU-CVE-2026-90954
Ubuntu:24.04:LTSbusyboxno fix listedUBUNTU-CVE-2026-90954
Ubuntu:26.04:LTSbusyboxno fix listedUBUNTU-CVE-2026-90954
Ubuntu:26.10busyboxno fix listedUBUNTU-CVE-2026-90954

Affected products (as reported)

VendorProductVersions
Red Hat Red Hat Hardened Images see references

Weakness: CWE-59 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References