CVE-2026-29518 is a TOCTOU symlink race condition vulnerability in the rsync daemon when 'use chroot = no' is configured. A local attacker with write permissions to an rsync module path can exploit the race condition to redirect file operations outside the intended module directory, potentially disclosing or overwriting files and escalating privileges if the daemon runs with elevated rights. The default configuration setting 'use chroot = yes' prevents this vulnerability by isolating the rsync process. Red Hat has released an update rebasing rsync to version 3.4.4 in Red Hat Enterprise Linux 10 that fixes this issue.

This vulnerability allows a local attacker with write access to an rsync module path to escalate privileges on the system by exploiting a race condition in the daemon when chroot is disabled. The attacker can read or overwrite files outside the intended directory, potentially compromising system integrity and confidentiality. The default configuration with chroot enabled is not affected, limiting exposure to systems explicitly configured with 'use chroot = no'.

Red Hat recommends ensuring the rsync daemon configuration uses 'use chroot = yes', which is the default setting and prevents this vulnerability. If 'use chroot = no' is set in /etc/rsyncd.conf, it should be changed to 'use chroot = yes' and the rsync service restarted. Additionally, applying the Red Hat update that rebases rsync to version 3.4.4 in Red Hat Enterprise Linux 10 will address this vulnerability.