GNU cpio 2.4.2 has a long-standing bug in it that causes infinite loops when unpacking input files with hard-linked empty files. It also has a security problem in that it sets the permissions on symlink targets instead of symlinks when there is no lchown() system call.
Fixed in cpio-2.4.2-13. Thanks for the patch.