CVE 2026 90954

A flaw was found in BusyBox's dpkg-deb archive extraction. The ar archive handler flushes deferred symlinks after each archive member, unlike the tar, cpio, and unzip handlers which flush once after the last member. A specially crafted .deb archive with two data.tar members can exploit this ordering: the first member declares a symlink pointing to an absolute path (e.g., '/'), which is deferred as unsafe but flushed after the first member. The second member declares a regular file whose path traverses the now-live symlink, resulting in a file being written outside the intended extraction directory. This could allow an attacker to write arbitrary files to arbitrary locations when a user extracts a crafted .deb package.

Red Hat product impact analysis is pending. Fedora ships busybox with the dpkg and dpkg-deb applets enabled and is confirmed affected. RHEL does not ship busybox as a standard package. The vulnerability requires the victim to extract a crafted .deb file using BusyBox dpkg-deb; RPM-based systems do not normally process .deb files, which limits practical exposure on Red Hat platforms. However, busybox dpkg-deb may be used in cross-platform build environments, container image construction, and firmware unpacking workflows.

Do not use BusyBox dpkg-deb to extract untrusted .deb packages. Use Debian's reference dpkg-deb implementation, which treats the extraction root as a boundary and is not affected by this issue. If BusyBox dpkg-deb must be used, inspect .deb archives for multiple data.tar members before extraction (legitimate .deb packages contain exactly one data.tar member).

Bugzilla 2533007 : busybox: busybox: dpkg-deb extraction-root escape via per-ar-member deferred symlink flush

CWE-59 : Improper Link Resolution Before File Access ('Link Following')

Common Vulnerability Scoring System (CVSS) Score Details

Info alert: Important note

CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications ).

The following CVSS metrics and score provided are preliminary and subject to review.

CVSS v3 Score Breakdown

Red Hat: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

cve.org: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Red Hat CVSS v3 Score Explanation

Kaiden verification 2026-10-13: ar handler per-member create_links_from_list() confirms extraction-root escape vs tar/cpio/unzip end-of-archive flush.

Understanding the Weakness (CWE)

Confidentiality,Integrity,Access Control

Technical Impact: Read Files or Directories; Modify Files or Directories; Bypass Protection Mechanism

An attacker may be able to traverse the file system to unintended locations and read or overwrite the contents of unexpected files. If the files are used for a security mechanism then an attacker may be able to bypass the mechanism.

Technical Impact: Execute Unauthorized Code or Commands

Windows simple shortcuts, sometimes referred to as soft links, can be exploited remotely since a ".LNK" file can be uploaded like a normal file. This can enable remote execution.

Red Hat would like to thank Shubham Raj (Causal Security) for reporting this issue.

Frequently Asked Questions

"Under investigation" doesn't necessarily mean that the product is affected by this vulnerability. It only means that our Analysis Team is still working on determining whether the product is affected and how it is affected.

The term 'Affected' means that our Analysis team has determined that this product, such as Red Hat Enterprise Linux 8 or OpenShift Container Platform 4, is affected by this vulnerability and a fix may be released to address this issue in the near future. This includes all minor releases of this product unless noted otherwise in the Statement text.

Upgrade to a supported product version that includes a fix for this vulnerability (recommended).

Apply a mitigation (if one exists).

Customers with the Technical Account Manager (TAM) RHEL Security Select Add-on can review this CVE directly with their TAM.

Apply a mitigation (if one exists).

Red Hat Engineering focuses on addressing high-priority issues based on the impact and product lifecycle expectations. Therefore, lower-priority issues will not receive immediate fixes.

Customers with the technical account manager (TAM) RHEL Security Select Add-on can review this CVE directly with their TAM.

Not sure what something means? Check out our Security Glossary .

For clarification or corrections, please Red Hat Product Security .