openSUSE rsync Important Arbitrary Code Execution Vulnern 2026-3634

Audit Linux privileges now to limit compromise, escalation, and system-wide damage. Review Linux Privileges ×

This update for rsync fixes the following issues:

* CVE-2026-53783: rrsync restricted-directory escape (validation-vs-exec race

+ unsafe option allowlist) (bsc#1269041).

* CVE-2026-53784: Daemon module-root chdir escape under "use chroot = no"

* CVE-2026-53785: --relative implied-parent creation escapes the destination

* CVE-2026-53786: Daemon --filter merge file bypasses the module filter list

* CVE-2026-53788: Daemon name-converter accepts newline-bearing names into its

line protocol (bsc#1269046).

* CVE-2026-53789: Malicious sender expands --delete scope by reclassifying an

implied parent (bsc#1269047).

* CVE-2026-53790: Command / argument injection via unquoted peer- or host-

controlled values (bsc#1269048).

* CVE-2026-53791: PROXY-protocol mode lets a direct client spoof the daemon's

source address (bsc#1269049).

* CVE-2026-53792: Receiver-supplied zero checksum block length...

## Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like

YaST online_update or "zypper patch".

Alternatively you can run the command listed for your product:

* SUSE Linux Enterprise Server for SAP Applications 15 SP4

zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP4-2026-3634=1

* SUSE Linux Enterprise High Performance Computing LTSS 15 SP4

zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-LTSS-2026-3634=1

* SUSE Linux Enterprise High Performance Computing LTSS 15 SP5

zypper in -t patch SUSE-SLE-Product-HPC-15-SP5-LTSS-2026-3634=1

zypper in -t patch SUSE-2026-3634=1

* SUSE Linux Enterprise Micro 5.5

zypper in -t patch SUSE-SLE-Micro-5.5-2026-3634=1

* SUSE Linux Enterprise Micro for Rancher 5.4

zypper in -t patch SUSE-SLE-Micro-5.4-2026-3634=1

* SUSE Linux Enterprise Micro 5.4

zypper in -t patch SUSE-SLE-Micro-5.4-2026-3634=1

* SUSE Linux Enterprise Server for SAP Applications 15 SP5

zypper in -t patch...

* SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5 (aarch64

* rsync-3.2.3-150400.3.34.1

* rsync-debugsource-3.2.3-150400.3.34.1

* rsync-debuginfo-3.2.3-150400.3.34.1

* SUSE Linux Enterprise Server 15 SP5 LTSS (aarch64 ppc64le s390x x86_64)

* rsync-3.2.3-150400.3.34.1

* rsync-debugsource-3.2.3-150400.3.34.1

* rsync-debuginfo-3.2.3-150400.3.34.1

* openSUSE Leap 15.4 (aarch64 i586 ppc64le s390x x86_64)

* rsync-3.2.3-150400.3.34.1

* rsync-debugsource-3.2.3-150400.3.34.1

* rsync-debuginfo-3.2.3-150400.3.34.1

* SUSE Linux Enterprise Server for SAP Applications 15 SP4 (ppc64le x86_64)

* rsync-3.2.3-150400.3.34.1

* rsync-debugsource-3.2.3-150400.3.34.1

* rsync-debuginfo-3.2.3-150400.3.34.1

* SUSE Linux Enterprise Server 15 SP4 LTSS (aarch64 ppc64le s390x x86_64)

* rsync-3.2.3-150400.3.34.1

* rsync-debugsource-3.2.3-150400.3.34.1

* rsync-debuginfo-3.2.3-150400.3.34.1

* SUSE Linux Enterprise Micro for Rancher 5.4 (aarch64 s390x x86_64)

* rsync-3.2.3-150400.3.34.1

*

*

*

*

*

*

*

*

*

Get the latest Linux and open source security news straight to your inbox.