This vulnerability arises from a race condition in rsync's handling of symbolic links. Rsync's default behavior is to skip symbolic links, but if an attacker replaces a regular file with a symbolic link at the right time, it can bypass this behavior and traverse symbolic links. This can lead to leakage of sensitive information or privilege escalation depending on the privileges of the rsync process. The issue affects multiple architectures of Red Hat Enterprise Linux 8 and 10. Red Hat has issued official security advisories and patches to fix this vulnerability as part of broader rsync updates addressing multiple CVEs including CVE-2024-12747.

The vulnerability allows an attacker with local access to exploit a race condition to bypass rsync's default symbolic link skipping behavior. This can lead to unauthorized traversal of symbolic links, potentially leaking sensitive information or enabling privilege escalation depending on the rsync process privileges. The CVSS score of 5.6 indicates moderate severity with high impact on confidentiality but no impact on integrity or availability. There are no known exploits in the wild at this time.

Official patches are available from Red Hat for Red Hat Enterprise Linux versions 8 and 10. Users should apply the security updates as described in the Red Hat advisories RHSA-2025:2600 and RHBA-2025:6470. The advisories provide updated rsync packages that fix the race condition vulnerability. No additional mitigations are required beyond applying these official fixes.