Description
A TOCTOU (Time-of-Check Time-of-Use) vulnerability in GNU tar's incremental dumpdir 'X' rename handling allows a local attacker with write access to a directory being backed up to influence the restore process if the attacker has access to the system where the restore is being performed. During restoration, files or directories may be created, renamed or overwritten outside the intended extraction directory. This could lead to unauthorized file modification or, in some cases, privilege escalation. Exploitation does not require the attacker to modify or craft the archive, and standard backup and restore workflows—including extracting into a newly created directory without using the -P option do not mitigate the issue.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | — | — |
| Red Hat | Red Hat Enterprise Linux 8 | — | — |
| Red Hat | Red Hat Enterprise Linux 9 | — | — |
| Red Hat | Red Hat Discovery 2 | — | — |
| Red Hat | Red Hat Hardened Images | — | — |
| Red Hat | Red Hat Update Infrastructure 5 | — | — |
| Red Hat | Red Hat Enterprise Linux 6 | — | — |
| Red Hat | Red Hat Enterprise Linux 7 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 5 | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | tar | No fix yet | — |
| Debian 13 | tar | No fix yet | — |
| Debian 12 | tar | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | tar | No fix yet | — |
| Ubuntu 26.04 LTS | tar | No fix yet | — |
| Ubuntu 24.04 LTS | tar | No fix yet | — |
| Ubuntu 22.04 LTS | tar | No fix yet | — |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 20.04 LTS | tar | No fix yet | — |
| Ubuntu Pro 18.04 LTS | tar | No fix yet | — |
| Ubuntu Pro 16.04 LTS | tar | No fix yet | — |
| Ubuntu Pro 14.04 LTS | tar | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | tar | 2:1.35-13.el10_2 | RHSA-2026:61586 |
| RHEL 9 | tar | 2:1.34-13.el9_8 | RHSA-2026:61581 |
| RHEL 8 | tar | 2:1.30-13.el8_10 | RHSA-2026:70390 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Hardened Images 1 | tar | 1.35-9.1.hum1 | RHSA-2026:49361 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | tar | 2:1.35-13.el10_2 | ALSA-2026:61586 |
| AlmaLinux 9 | tar | 2:1.34-13.el9_8 | ALSA-2026:61581 |
| AlmaLinux 8 | tar | 2:1.30-13.el8_10 | ALSA-2026:70390 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | tar | 2:1.35-13.el10_2 | RLSA-2026:61586 |
| Rocky Linux 9 | tar | 2:1.34-13.el9_8 | RLSA-2026:61581 |
| Rocky Linux 8 | tar | 2:1.30-13.el8_10 | RLSA-2026:70390 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | tar | 1.34-150000.3.45.1 | SUSE-SU-2026:5160-1 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLE Micro 5.5 | tar | 1.34-150000.3.45.1 | SUSE-SU-2026:5160-1 |
| SLE Micro 5.4 | tar | 1.34-150000.3.45.1 | SUSE-SU-2026:5160-1 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | tar | No fix yet | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 8 | tar | 2:1.30-13.el8_10 | ELSA-2026-70390 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | gnutar +2 | No fix yet | — |
Advisories 13
- WID-SEC-2026-2633 GNU tar: Mehrere Schwachstellen ermöglichen Manipulation von Dateien BSI CERT-Bund (WID) · Nov 10, 2026
- SUSE-SU-2026:5160-1 Security update for tar SUSE / openSUSE Security Updates · Nov 10, 2026
- ALSA-2026:61581 Moderate: tar security, bug fix, and enhancement update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:61586 Moderate: tar security, bug fix, and enhancement update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:70390 Moderate: tar security, bug fix, and enhancement update AlmaLinux Security Advisories · Oct 29, 2026
- RLSA-2026:70390 Moderate: tar security, bug fix, and enhancement update Rocky Linux Security Advisories · Sep 24, 2026
- RHSA-2026:70390 Red Hat Security Advisory: tar security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Sep 23, 2026
- RHSA-2026:61586 Red Hat Security Advisory: tar security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Sep 23, 2026
- RHSA-2026:61581 Red Hat Security Advisory: tar security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Sep 23, 2026
- RHSA-2026:49361 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Sep 23, 2026
- ELSA-2026-70390 Moderate: tar security, bug fix, and enhancement update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Sep 23, 2026
- RLSA-2026:61586 Moderate: tar security, bug fix, and enhancement update Rocky Linux Security Advisories · Sep 11, 2026
- RLSA-2026:61581 Moderate: tar security, bug fix, and enhancement update Rocky Linux Security Advisories · Sep 1, 2026
References
- RHSA-2026:49361 vendor-advisory
- RHSA-2026:61581 vendor-advisory
- RHSA-2026:61586 vendor-advisory
- RHSA-2026:61783 vendor-advisory
- RHSA-2026:66018 vendor-advisory
- RHSA-2026:70390 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2026-18477 vdb-entry
- RHBZ#2509735 issue-tracking