CVE-2026-53796

A time-of-check to time-of-use (TOCTOU) race condition in rsync's non-daemon receiver allows a local attacker to compromise data integrity. By substituting a symbolic link for a destination path component during directory processing, an attacker can redirect file writes to unintended locations.

A Moderate severity time-of-check to time-of-use (TOCTOU) race condition in the rsync non-daemon receiver allows a local attacker to redirect file writes to unintended locations. To exploit this flaw, the attacker must manipulate destination path parent components during an active rsync operation. The vulnerability is rated Moderate because successful exploitation is highly dependent on specific environmental conditions and user interaction.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this avoid running privileged rsync into destination paths modifiable by untrusted users, and enable kernel-level protections by setting fs.protected_symlinks = 1 in your system's sysctl.conf to block the underlying race condition.