CVE-2026-29518 is a TOCTOU race condition vulnerability in rsync daemon file handling prior to version 3.4.3. The flaw occurs when the chroot setting is false, enabling attackers with write access to a module path to replace parent directory components with symbolic links during file operations. This race condition allows redirection of file writes outside intended directories, enabling creation or overwriting of arbitrary files. If the rsync daemon runs with elevated privileges, this can lead to privilege escalation. The vulnerability has a CVSS 4.0 base score of 7.3, indicating high severity. Red Hat advisories confirm the issue and provide updates rebasing rsync to version 3.4.4 to address this and other vulnerabilities.

An attacker with write access to the rsync module path can exploit this race condition to create or overwrite arbitrary files outside the intended directory structure. This can result in modification of sensitive system files and potential privilege escalation when the rsync daemon operates with elevated privileges. The vulnerability requires the daemon to run without chroot enabled, limiting the attack surface but still posing a significant risk in affected configurations.

Red Hat has released updates rebasing rsync to version 3.4.4 that fix this TOCTOU race condition vulnerability. Users should apply the official security updates provided by Red Hat for their respective distributions to remediate this issue. Since the vulnerability only occurs when the daemon runs without chroot, enabling chroot can also mitigate the risk. Patch status is confirmed by Red Hat advisories linked in the vendor advisory URLs. No known exploits are reported in the wild at this time.