CVE-2026-18477: GNU tar TOCTOU Privilege Escalation Flaw

CVE-2026-18477 Overview

CVE-2026-18477 is a Time-of-Check Time-of-Use (TOCTOU) race condition in GNU tar's incremental dumpdir X rename handling. A local attacker with write access to a directory being backed up can influence the restore process on the target system. During restoration, files or directories may be created, renamed, or overwritten outside the intended extraction directory. Exploitation does not require the attacker to modify or craft the archive itself. Standard backup and restore workflows, including extracting into a newly created directory without the -P option, do not mitigate the issue. The flaw is tracked under CWE-367.

Critical Impact
Successful exploitation enables unauthorized file modification outside the extraction directory and, in some scenarios, local privilege escalation on the system performing the restore.

Affected Products

GNU tar (incremental backup functionality using dumpdir X records)
Red Hat Enterprise Linux distributions shipping affected tar builds
Downstream Linux distributions packaging vulnerable GNU tar versions

Discovery Timeline

2026-08-03 - CVE-2026-18477 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-18477

Vulnerability Analysis

GNU tar supports incremental backups using dumpdir metadata that records directory state between backup runs. Entries prefixed with X indicate renamed items that tar must resolve during restoration. The vulnerability arises because tar checks the state of these renamed paths and then acts on them without atomically binding the check to the operation. An attacker with write access to a directory being backed up can manipulate the filesystem between the check and the use, causing tar to operate on a path different from the one it validated. The restore process then creates, renames, or overwrites files outside the intended extraction directory. The attack is impactful because it does not require tampering with the archive, and it bypasses the common defense of extracting into a fresh empty directory.

Root Cause

The root cause is a classic TOCTOU flaw in the code path that processes dumpdir X rename entries. Tar resolves and validates a path, then performs a rename or extraction based on that earlier state. Filesystem changes introduced by a local attacker between these two steps are not detected, so the operation acts on attacker-controlled paths.

Attack Vector

Exploitation requires local access on the backed-up host and access to the system where the restore executes. The attacker plants directory structures or symbolic links in a path included in an incremental backup. When an administrator later runs an incremental restore, tar processes the X rename records and follows the attacker-influenced paths. Because the restore typically runs with elevated privileges, this can lead to overwriting files outside the extraction root or escalating privileges. User interaction, in the form of an administrator initiating the restore, is required.

Exploitation flow (prose description, no verified PoC available):
1. Attacker with write access seeds the source directory with crafted
   entries and symlinks that will be captured in an incremental dump.
2. Tar records dumpdir metadata, including 'X' entries for renamed items.
3. During restore, tar validates the target of an 'X' record.
4. Attacker races the operation to swap the path (e.g., via symlink).
5. Tar performs the rename/creation on the swapped path, writing files
   outside the intended extraction directory.

Detection Methods for CVE-2026-18477

Indicators of Compromise

Files or directories appearing outside the declared extraction root after an incremental tar restore operation.
Unexpected symbolic links or directory replacements inside source paths that are regularly captured by incremental backups.
Restore logs showing X (rename) dumpdir entries resolving to paths outside the extraction target.

Detection Strategies

Audit incremental tar restore operations by comparing the file list in the archive against files actually written to disk after extraction.
Monitor for tar processes invoked with --listed-incremental or -g that write outside their declared extraction directory.
Correlate filesystem writes performed by tar with the target extraction path using kernel audit rules (auditd path= watches).

Monitoring Recommendations

Enable Linux auditd rules on execve for /usr/bin/tar and on rename, renameat, and symlink syscalls issued by the tar process.
Log and review who has write access to directories included in scheduled incremental backup jobs.
Alert on symlink creations within backup source trees performed by non-root, non-service accounts shortly before scheduled backup windows.

How to Mitigate CVE-2026-18477

Immediate Actions Required

Apply the vendor-supplied tar package update as soon as it is available from your distribution, including the fix referenced in Red Hat Security Advisory RHSA-2026:49361.
Restrict write access to directories included in incremental backups so that untrusted local users cannot introduce crafted entries.
Perform restore operations on isolated systems or in containers, not directly onto production filesystems, until patched.

Patch Information

Red Hat has published fixed packages via RHSA-2026:49361. Additional vendor details are available in the Red Hat CVE-2026-18477 advisory and Red Hat Bugzilla #2509735. Update GNU tar on all systems that perform incremental backups or restores.

Workarounds

Avoid running incremental restores as root when the archive originates from a system where untrusted users have write access to backed-up directories.
Verify archive contents with tar --list --listed-incremental and cross-check paths before performing a live restore.
Restore to a chroot or dedicated non-privileged filesystem sandbox, then move validated files into place manually.

bash

# Verify installed tar version and update on Red Hat-based systems
rpm -q tar
sudo dnf update tar

# Debian/Ubuntu
dpkg -s tar | grep Version
sudo apt-get update && sudo apt-get install --only-upgrade tar

# Audit rule to log tar invocations for incremental operations
sudo auditctl -w /usr/bin/tar -p x -k tar_exec