Skip to content
CVE-2026-90954: BusyBox Archive Extraction Vulnerability

CVE-2026-90954: BusyBox Archive Extraction Vulnerability

First seen 15 Oct 2026, 01:38 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 15, 2026 at 02:34 UTC
  • •CVE-2026-90954 allows file writes outside intended directories via crafted .deb packages.
  • •Affected systems include embedded Linux and container environments using BusyBox.
  • •Red Hat advises against using BusyBox dpkg-deb for untrusted packages until a fix is available.

A vulnerability identified as CVE-2026-90954 affects BusyBox's dpkg-deb archive extraction, allowing crafted .deb packages to exploit the order of symlink flushing. This flaw can enable attackers to write files outside the intended extraction directory, posing a high-impact risk. The vulnerability primarily affects systems using BusyBox, particularly in embedded Linux, container environments, and build processes. Red Hat has confirmed that Fedora is affected, while RHEL does not ship BusyBox by default. Users are advised against extracting untrusted .deb packages with BusyBox's dpkg-deb and to use Debian's reference implementation instead. The risk of exploitation depends on user interaction with untrusted packages, and active exploitation has not been confirmed. Red Hat's product impact analysis is still pending.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-14
CVE-2026-90954 published
The vulnerability was officially published, detailing the flaw in BusyBox's dpkg-deb extraction process.
Redpacketsecurity

More articles in this cluster (2)

Following this threat?

Track Red Hat and CVE-2026-90954 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (8)

1 / 3

Common questions

Which systems are affected by CVE-2026-90954?
The vulnerability affects systems using BusyBox's dpkg-deb, notably Fedora and environments that handle .deb packages.
Is there a known exploit for this vulnerability?
No active exploitation has been confirmed, but the risk exists when untrusted packages are extracted.
What should I do to mitigate this risk?
Avoid using BusyBox dpkg-deb for untrusted .deb packages and use the Debian reference implementation instead.