CVE-2026-53799 describes a symlink race condition vulnerability in rsync before version 3.5.0. The vulnerability arises because rsync applies ACLs or extended attributes to files after writing them, but an attacker can replace the intended file with a symbolic link during the time between the file write and the acl_set_file() or lsetxattr() system calls. This allows redirection of ACL and xattr application to arbitrary files outside the intended destination tree, potentially enabling local privilege escalation by granting elevated permissions to unintended files.

Local attackers with the ability to write to the destination path can exploit this vulnerability to redirect ACL and extended attribute application to arbitrary files. This can result in unauthorized modification of file permissions or attributes, potentially leading to local privilege escalation. The vulnerability requires local access and high attack complexity but does not require user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid running rsync with elevated privileges on untrusted input or in environments where local attackers can manipulate destination paths. Monitor vendor communications for updates and apply patches promptly once released.