CVE Alert: CVE-2026-90954 – Red Hat

A flaw was found in BusyBox’s dpkg-deb archive extraction. The ar archive handler flushes deferred symlinks after each archive member, unlike the tar, cpio, and unzip handlers which flush once after the last member. A specially crafted .deb archive with two data.tar members can exploit this ordering: the first member declares a symlink pointing to an absolute path (e.g., ‘/’), which is deferred as unsafe but flushed after the first member. The second member declares a regular file whose path traverses the now-live symlink, resulting in a file being written outside the intended extraction directory. This could allow an attacker to write arbitrary files to arbitrary locations when a user extracts a crafted .deb package.

**Risk verdict:** High-impact file-write risk, but exploitation urgency cannot be confirmed because KEV, SSVC, PoC and EPSS data are not provided.

**Why this matters:** A crafted package can turn an extraction operation into writes outside its intended directory, potentially overwriting system files, altering configuration or establishing persistence. The practical risk depends on whether users or automated workflows handle untrusted packages; the supplied data does not establish active exploitation.

**Most likely attack path:** An attacker places a malicious package where a user or build process will extract it, then relies on that interaction to trigger the flaw. The attack is local, requires no attacker privileges and has low complexity, but user interaction is required; Scope is unchanged, so impacts are generally limited to the authority of the extracting process rather than implying automatic lateral movement.

**Who is most exposed:** Embedded or minimal Linux systems, containers, and build or recovery environments that use lightweight package tools are most exposed, especially where package extraction occurs as root.

Alert on extraction processes writing outside their designated staging directory.

Review package archives for multiple `data.tar` members before extraction.

Check for unexpected changes to system files following package handling.

Mitigation and prioritisation

Apply the relevant vendor fix when available; confirm package status across deployed images.

Until patched, do not use the affected extractor on untrusted packages.

Prefer the reference package extractor; if unavoidable, reject archives with multiple `data.tar` members.

Test image and build-pipeline changes before rollout; preserve logs for suspicious extraction events.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.