The rsync utility in Red Hat Enterprise Linux 9 contains two security flaws: CVE-2024-12086, where the rsync server can leak arbitrary client files, and CVE-2026-41035, a use-after-free vulnerability related to extended attribute handling. These vulnerabilities could potentially expose sensitive client data or cause memory corruption. Red Hat has released updated rsync packages (version 3.2.5-7.el9_8) across multiple supported architectures to fix these issues. The advisory classifies the update as important and provides detailed package information and instructions for applying the update.

The first vulnerability may lead to unauthorized disclosure of arbitrary client files by the rsync server, potentially exposing sensitive information. The second vulnerability could result in memory corruption due to a use-after-free condition, which might be exploitable to cause denial of service or other impacts. No confirmed exploits in the wild have been reported. The overall security impact is rated as important by Red Hat.

Red Hat has released updated rsync packages that address these vulnerabilities. Users of affected Red Hat Enterprise Linux 9 versions should apply the security update as described in the Red Hat advisory RHSA-2026:19368 and the referenced article https://access.redhat.com/articles/11258. Applying these official patches is the recommended and effective mitigation. No additional mitigations are specified or required beyond applying the update.