CVE-2026-29518

A flaw was found in rsync. An rsync daemon configured with "use chroot = no" is exposed to a time-of-check / time-of-use race on parent path components. A local attacker with write access to a module can replace a parent directory component with a symlink between the receiver's check and its open(), redirecting reads (basis-file disclosure) and writes (file overwrite) outside the module. Under elevated daemon privilege this allows privilege escalation. Default "use chroot = yes" is not exposed. Reach: local attacker on the daemon host, write access to a module path, daemon configured with use chroot = no.

This flaw, a Time-of-Check Time-of-Use (TOCTOU) race condition, allows a local attacker with write access to an rsync module path to achieve privilege escalation. This vulnerability specifically impacts rsync daemons configured with use chroot = no. Red Hat's default rsync daemon configuration utilizes use chroot = yes, which is not susceptible to this issue.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To prevent exploitation, ensure the rsync daemon is configured with use chroot = yes. This setting, which is the default, isolates the rsync process and prevents the symlink race condition. If use chroot = no is present in the rsync configuration (e.g., /etc/rsyncd.conf), it must be changed to use chroot = yes. A restart of the rsync service is required for any configuration changes to take effect.