CVE-2026-90954 Red Hat CVE debrief

Who should care

Defenders and administrators using BusyBox in Red Hat Hardened Images should assess exposure and take necessary actions to prevent potential attacks. This includes verifying BusyBox versions and configurations, monitoring for suspicious .deb package extraction activity, and implementing compensating controls for exposed systems while remediation is scheduled and verified.

Why it matters

CVE-2026-90954 is a high-severity vulnerability in BusyBox's dpkg-deb archive extraction. Defenders and administrators using BusyBox in Red Hat Hardened Images should assess exposure and take necessary actions to prevent potential attacks. The vulnerability allows an attacker to write arbitrary files to arbitrary locations when a user extracts a crafted .deb package. Verification of BusyBox versions and configurations is necessary, and monitoring for suspicious activity related to .deb package extraction is important.

• Potential arbitrary file writes outside intended extraction directory
• Possible exploitation via crafted .deb packages
• Need for verification of BusyBox versions and configurations
• Importance of monitoring for suspicious .deb package extraction activity

Technical summary

A flaw in BusyBox's dpkg-deb archive extraction allows an attacker to write arbitrary files to arbitrary locations when a user extracts a crafted .deb package. This is due to the ar archive handler flushing deferred symlinks after each archive member, unlike other handlers. The vulnerability enables exploitation via crafted .deb packages, potentially leading to arbitrary file writes outside the intended extraction directory. Verification of BusyBox versions and configurations is necessary, and monitoring for suspicious activity related to .deb package extraction is important.

Defensive priority

High

Recommended defensive actions

• Review and assess exposure of BusyBox installations to this vulnerability
• Verify if BusyBox is used in Red Hat Hardened Images and take necessary actions
• Monitor for any suspicious activity related to .deb package extraction
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and source item provide details on a flaw in BusyBox's dpkg-deb archive extraction, allowing an attacker to write arbitrary files to arbitrary locations. The NVD entry is currently UNASSIGNED.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.