CVE-2026-90954: Improper Link Resolution Before File Access ('Link Following') in Red Hat Red Hat Hardened Images

The vulnerability arises from the ar archive handler in BusyBox's dpkg-deb extraction process, which flushes deferred symlinks after each archive member rather than once after the last member as done by other handlers. An attacker can craft a .deb archive with two data.tar members: the first creates a deferred symlink to an absolute path, which is flushed prematurely, and the second contains a file path that traverses this symlink. This results in files being written outside the extraction directory, enabling arbitrary file writes.

Successful exploitation allows an attacker to write arbitrary files to arbitrary locations on the filesystem during extraction of a malicious .deb package. This can lead to system compromise, data corruption, or privilege escalation depending on the files overwritten.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-90954 for current remediation guidance. Until a fix is applied, avoid extracting untrusted .deb packages with vulnerable BusyBox versions.