CVE-2026-90954 — Red Hat
HIGHCVE-2026-90954 is a high-severity (CVSS 7.8) CWE-59 vulnerability. No vendor fix is recorded yet; mitigation options are listed below.
A flaw was found in BusyBox's dpkg-deb archive extraction. The ar archive handler flushes deferred symlinks after each archive member, unlike the tar, cpio, and unzip handlers which…
Description
A flaw was found in BusyBox's dpkg-deb archive extraction. The ar archive handler flushes deferred symlinks after each archive member, unlike the tar, cpio, and unzip handlers which flush once after the last member. A specially crafted .deb archive with two data.tar members can exploit this ordering: the first member declares a symlink pointing to an absolute path (e.g., '/'), which is deferred as unsafe but flushed after the first member. The second member declares a regular file whose path traverses the now-live symlink, resulting in a file being written outside the intended extraction directory. This could allow an attacker to write arbitrary files to arbitrary locations when a user extracts a crafted .deb package.
Detection & mitigation playbook
VulnerabilityDetect
Identify every host running the affected component and compare the installed build against the fixed version below — for source-built or distro-packaged software the version string, not a lockfile, is the source of truth (`dpkg -l`, `rpm -q`, or the binary's own `--version`).
Remediation status
No fixed release is recorded for CVE-2026-90954 yet. Track the upstream advisory, and apply the exposure-reduction steps below in the meantime.
Mitigate without a patch
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
Fixing This On Your OS
If you run this on a Linux distribution, patch through your package manager against the distro's own security advisory below — it tracks the exact backported fix for your release, which can ship on a different timeline (and sometimes a different severity) than the upstream project.
Red Hat product impact analysis is pending. Fedora ships busybox with the dpkg and dpkg-deb applets enabled and is confirmed affected. RHEL does not ship busybox as a standard package. The vulnerability requires the victim to extract a crafted .deb file using BusyBox dpkg-deb; RPM-based systems do not normally process…
Do not use BusyBox dpkg-deb to extract untrusted .deb packages. Use Debian's reference dpkg-deb implementation, which treats the extraction root as a boundary and is not affected by this issue. If BusyBox dpkg-deb must be used, inspect .deb archives for multiple data.tar members before extraction (legitimate .deb packages contain exactly one data.tar member).Source: Red Hat security advisory for CVE-2026-90954 (CC BY 4.0)
Frequently Asked Questions
Is CVE-2026-90954 in your dependencies?
Find it across , including transitive dependencies.