Back Linuxsecurity

Fedora 42 Rust-Resctl-Bench Important Permissions Issue CVE-2026

Linuxsecurity •LinuxSecurity Advisories • April 1, 2026

resctl-bench is a collection of whole-system benchmarks to evaluate resource control and hardware behaviors using realistic simulated workloads. Comprehensive resource control involves the whole system. Furthermore, testing resource control end-to-end requires scenarios involving realistic workloads and monitoring their interactions. The combination makes benchmarking resource control challenging and error-prone. It's easy to slip up on a configuration and testing with real workloads can be tedious and unreliable. resctl-bench encapsulates the whole process so that resource control benchmarks can be performed easily and reliably. It verifies and updates system configurations, reproduces resource contention scenarios with a realistic latency-sensitive workload simulator and other secondary workloads, analyzes the resulting system and workload behaviors, and generates easily understandable reports. Update Information : Rebuilt with rust-tar 0.4.45 for CVE-2026-33056

resctl-bench is a collection of whole-system benchmarks to evaluate resource

control and hardware behaviors using realistic simulated workloads.

Comprehensive resource control involves the whole system. Furthermore, testing

resource control end-to-end requires scenarios involving realistic workloads

and monitoring their interactions. The combination makes benchmarking resource

control challenging and error-prone. It's easy to slip up on a configuration

and testing with real workloads can be tedious and unreliable.

resctl-bench encapsulates the whole process so that resource control benchmarks

can be performed easily and reliably. It verifies and updates system

configurations, reproduces resource contention scenarios with a realistic

latency-sensitive workload simulator and other secondary workloads, analyzes

the resulting system and workload behaviors, and generates easily

understandable reports.

Rebuilt with rust-tar 0.4.45 for CVE-2026-33056

* Mon Mar 23 2026 Benjamin A. Beasley - 2.2.5-12 - Rebuilt with rust-tar 0.4.45 for CVE-2026-33056 - Updated the License expression * Mon Mar 23 2026 Benjamin A. Beasley - 2.2.5-11 - Rebuilt with rust-tar 0.4.45 for CVE-2026-33056

[ 1 ] Bug #2450241 - rust-resctl-bench: tar-rs: Arbitrary directory permission modification via crafted tar archive

This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-dd42661781' at the command line. For more information, refer to the dnf documentation available at

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Permissions Vulnerability in Fedora's Rust-Resctl-Bench Tool A significant permissions vulnerability has been identified in the Fedora Rust-Resctl-Bench tool, linked to CVE-2026-33056, published on March 20, 2026. This issue allows for arbitrary directory permission modifications via crafted tar archives, potentially impacting systems using this benchmarking tool. The vulnerability arises from improper handling of permissions when extracting tar files, which could lead to unauthorized access or privilege escalation. Users of Fedora 42 and Fedora 44 are advised to update their systems to mitigate this risk. The vulnerability was addressed in updates released on March 23, 2026, by Benjamin A. Beasley, who rebuilt the tool with rust-tar version 0.4.45. The update can be installed using the 'dnf' package manager. Security professionals are urged to apply the patch promptly to prevent exploitation. The scope of impact is significant, given the tool's use in evaluating resource control and hardware behaviors. 2 sources 58

Extracted Entities

Companies (1)

Fedora

CVEs (1)

CVE-2026-33056