CVE-2026-18477 is a local privilege escalation vulnerability in GNU tar's incremental dumpdir 'X' rename handling due to a TOCTOU race condition. A local attacker who can write to a directory included in an incremental backup and who has access to the system where the backup is restored can cause the restore process to create, rename, or overwrite files outside the intended extraction directory. This vulnerability affects the tar package version 1.35-9.1.hum1 in Red Hat Hardened Images for aarch64 and x86_64 architectures. The attacker does not need to modify the archive, and standard extraction methods do not prevent exploitation. Red Hat has published an advisory (RHSA-2026:49361) describing the issue and mitigation recommendations but has not yet released a patch. The vulnerability is classified under CWE-367 (Time-of-check Time-of-use Race Condition) and has a Red Hat CVSS v3 score of 4.4 (medium severity).

The vulnerability allows a local attacker with write access to a directory included in an incremental backup and access to the restore system to cause files or directories to be created, renamed, or overwritten outside the intended extraction directory during restoration. This can lead to unauthorized file modification and, in some cases, privilege escalation. The attacker does not need to modify the archive or craft a malicious archive, and extraction into a new directory without the -P option does not mitigate the issue. The integrity of the system can be compromised, potentially allowing unauthorized access or modification of files.

Red Hat advises not to perform incremental restores (-G/-g) from untrusted archives. Restoration should only be performed on systems inaccessible to untrusted users. Avoid restoring incremental backups on systems where untrusted users have shell access. There is currently no official fix or patch released by Red Hat for this vulnerability. Users should monitor Red Hat advisories for updates and apply patches once available.