Bug 2439040 (CVE-2026-26158)

Summary:	CVE-2026-26158 busybox: BusyBox: Arbitrary file modification and privilege escalation via unvalidated tar archive entries
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	adudiak, aprice, caswilli, dfreiber, drow, jburrell, jsamir, kaycoth, kshier, oezr, stcannon, teagle, vkumar, yguenane
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in BusyBox. This vulnerability allows an attacker to modify files outside of the intended extraction directory by crafting a malicious tar archive containing unvalidated hardlink or symlink entries. If the tar archive is extracted with elevated privileges, this flaw can lead to privilege escalation, enabling an attacker to gain unauthorized access to critical system files.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2439048, 2439049, 2439050
Bug Blocks:

Description OSIDB Bzimport 2026-02-11 18:13:37 UTC

Affects: BusyBox v1.36.1 and v1.37.0 (likely affects earlier versions too)
CVSS: 9.3 (CRITICAL)
Component: data_extract_all.c in tar extraction - hardlink and symlink
handling

Description:
Hardlink entries in tar archives are created without validation of the
link_target path. This allows modification of files outside the extraction
directory and bypasses existing path traversal mitigations. This
vulnerability has higher impact than the path traversal issue as it does
not rely on relative paths or the current working directory.

Technical Details:
- Hardlink entries can point to absolute paths like /etc/passwd
- Symlink entries suffer from the same root cause (missing link_target
validation)
- When extraction is performed with elevated privileges, attackers can
modify critical system files

Impact:
Arbitrary file modification outside extraction directory, privilege
escalation when combined with elevated extraction permissions, bypass of
path traversal protections.

Note: While hardlinks and symlinks share the same root cause (missing
link_target validation), I'm requesting a single CVE for this issue.