CVE-2026-108119 Red Hat CVE debrief

Who should care

Defenders responsible for BusyBox installations, particularly in environments where elevated privileges are involved, should assess exposure and prioritize verification and patching.

Why it matters

CVE-2026-108119 is a vulnerability in the BusyBox tar applet that allows for tar extraction-root escape via deferred symlink/hardlink creation, potentially leading to privilege escalation or arbitrary code execution. Defenders should prioritize verifying and patching BusyBox installations, particularly in environments where elevated privileges are involved.

• Potential privilege escalation
• Potential arbitrary code execution
• Need for verification of BusyBox installations
• Need for monitoring of suspicious tar extraction activity

Technical summary

The BusyBox tar applet's deferred link-creation handling for symlink and hardlink entries with unsafe-looking targets does not validate that the resolved destination remains inside the extraction directory once the deferred link is created. This allows an attacker to craft a tar archive using a symlink target of exactly '..' combined with a deferred hardlink to create a new file outside the extraction directory, or reuse an extraction directory across two archives to replace an existing file outside it.

Defensive priority

Defenders should prioritize verifying and patching BusyBox installations, particularly in environments where elevated privileges are involved.

Recommended defensive actions

• Verify and patch BusyBox installations
• Review and update extraction directory permissions
• Monitor for suspicious tar extraction activity
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The vulnerability is caused by the tar applet's deferred link-creation handling for symlink and hardlink entries with unsafe-looking targets not validating that the resolved destination remains inside the extraction directory once the deferred link is created.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.