The rsync utility in Red Hat Enterprise Linux 9.6 Extended Update Support and related distributions contains multiple vulnerabilities: CVE-2024-12086 allows the rsync server to leak arbitrary client files; CVE-2025-10158 involves an out-of-bounds array access via a negative index; and CVE-2026-41035 is a use-after-free vulnerability in extended attribute handling. These vulnerabilities have been fixed in updated rsync packages provided by Red Hat. The advisory RHSA-2026:20603 details the fixes and affected product variants. The CVSS vector for CVE-2024-12086 indicates network attack vector with high confidentiality impact but no integrity or availability impact. Red Hat recommends applying the updated packages to remediate these issues.

Successful exploitation of CVE-2024-12086 could lead to unauthorized disclosure of arbitrary client files from the rsync server, impacting confidentiality. CVE-2025-10158's out-of-bounds array access could cause crashes or undefined behavior, potentially leading to denial of service. CVE-2026-41035's use-after-free vulnerability in extended attribute handling could also lead to memory corruption and denial of service. There is no indication of known exploits in the wild. The overall impact is rated as high due to the confidentiality breach and potential service disruption.

Red Hat has released updated rsync packages for Red Hat Enterprise Linux 9.6 Extended Update Support and related variants that address these vulnerabilities. Users should apply these official security updates as detailed in Red Hat advisory RHSA-2026:20603. The advisory provides package names and instructions for updating. No additional mitigations are specified or required beyond applying the vendor-provided patches.