CVE-2026-29518 is a TOCTOU race condition vulnerability in rsync daemon file handling prior to version 3.4.3. The flaw arises when the chroot setting is false, allowing an attacker with write access to a module path to replace parent directory components with symbolic links during file synchronization. This can redirect file writes outside the intended directory, enabling creation or overwriting of arbitrary files. If the rsync daemon runs with elevated privileges, this can lead to privilege escalation. Red Hat has issued an advisory (RHSA-2026:26332) providing a security update that rebases rsync to version 3.4.4, which fixes this vulnerability.

Attackers with write access to the rsync module path can exploit this race condition to create or overwrite arbitrary files outside the intended directories. This can result in modification of sensitive system files and potential privilege escalation when the rsync daemon runs with elevated privileges and chroot is disabled. The vulnerability has a CVSS score of 7.3 (high severity). There are no known exploits in the wild at this time.

A security update rebasing rsync to version 3.4.4 is available from Red Hat as detailed in advisory RHSA-2026:26332. Applying this update will remediate the TOCTOU race condition vulnerability. Users should upgrade affected rsync packages to version 3.4.4 or later. Since this is not a cloud service, remediation is the responsibility of the system administrator. Patch status is confirmed by the vendor advisory.