The rsync utility in Red Hat Enterprise Linux 9.2 contains two security flaws: an out-of-bounds array access triggered by a negative index (CVE-2025-10158) and a use-after-free vulnerability in the handling of extended attributes (CVE-2026-41035). Both vulnerabilities could lead to memory safety issues, such as crashes or potential exploitation. Red Hat Product Security has issued an important security advisory (RHSA-2026:20602) and released patched rsync packages (version 3.2.3-19.el9_2.3) for affected systems. The advisory covers multiple architectures including x86_64, ppc64le, aarch64, and s390x. No CVSS scores are provided in the advisory, but the severity is rated as important (high).

Successful exploitation of these vulnerabilities could result in out-of-bounds memory access or use-after-free conditions, potentially causing application crashes or enabling further exploitation depending on the context. The vulnerabilities affect the rsync utility, which is commonly used for file synchronization and mirroring, so exploitation could impact systems performing these operations. No known exploits in the wild have been reported at this time.

Red Hat has released updated rsync packages that address these vulnerabilities. Users of Red Hat Enterprise Linux 9.2 and related variants should apply the security update as soon as possible by following the instructions in the Red Hat advisory (https://access.redhat.com/articles/11258). The update includes rsync version 3.2.3-19.el9_2.3 for multiple architectures. Applying this official fix mitigates the vulnerabilities. No additional mitigation steps are indicated by the vendor.