CVE-2026-66485 Overview
CVE-2026-66485 is an uncontrolled memory allocation vulnerability in GNU cpio, an archive utility distributed with most Linux and Unix systems. The flaw resides in the make_path function within src/makepath.c. During archive extraction, the function calls alloca to allocate stack memory based on the length of argpath, a value derived from an attacker-controlled pathname inside the archive. A crafted cpio archive containing a sufficiently long nested pathname triggers an unbounded stack allocation, causing a stack overflow and crash of the cpio process. Exploitation requires a victim to extract a malicious archive, resulting in denial of service. The issue is tracked under [CWE-789: Memory Allocation with Excessive Size Value].
Critical Impact
An attacker who convinces a user to extract a crafted cpio archive can crash the cpio process, disrupting backup, packaging, and initramfs workflows that depend on it.
Affected Products
- GNU cpio versions prior to the fix commit 3cd514031371d8aeeaf2048aa10103e02831aaa9
- Linux distributions bundling vulnerable cpio releases
- Build and packaging pipelines that invoke cpio for archive extraction
Discovery Timeline
- 2026-08-10 - CVE-2026-66485 published to the National Vulnerability Database
- 2026-08-10 - Last updated in NVD database
Technical Details for CVE-2026-66485
Vulnerability Analysis
GNU cpio processes archives by reconstructing directory hierarchies at extraction time. The make_path function in src/makepath.c is responsible for creating intermediate directories along a nested path. It uses alloca to allocate a scratch buffer sized according to the length of the argpath argument. Because alloca allocates on the stack and does not perform bounds checking, the size passed to it must be trusted.
In this case, argpath is derived directly from a pathname stored inside the archive. An attacker who controls the archive controls the length of that string. Supplying a pathname long enough to exceed the available stack space causes alloca to move the stack pointer beyond the guard page, producing a segmentation fault and terminating the cpio process.
The upstream fix in commit 3cd514031371d8aeeaf2048aa10103e02831aaa9 removes the reliance on unbounded stack allocation for archive-controlled data.
Root Cause
The root cause is trusting archive-supplied input to size a stack allocation. alloca is well-known to be unsafe when the size argument is not strictly bounded. The extraction path performs no upper limit check on argpath length before invoking alloca, allowing the stack pointer to be advanced into unmapped memory.
Attack Vector
The attack requires local user interaction. An attacker crafts a cpio archive containing a deeply nested pathname whose total length exceeds the process stack limit. The attacker then delivers the archive to a victim through email attachments, package downloads, or automated ingestion pipelines. When the victim extracts the archive with cpio -i or a wrapper such as rpm2cpio | cpio, the extraction process crashes.
Because no memory-safety corruption follows the crash, the impact is limited to denial of service. However, systems that rely on cpio for automated tasks such as initramfs generation, package extraction, or backup restoration can suffer operational disruption.
See the CERT Polska advisory and the GNU cpio repository for further technical detail.
Detection Methods for CVE-2026-66485
Indicators of Compromise
- Repeated segmentation faults or SIGSEGV events from the cpio process in system logs or dmesg output.
- Unexpected termination of extraction pipelines that invoke cpio, such as rpm2cpio or initramfs unpacking.
- Cpio archives containing pathnames whose length exceeds several kilobytes, particularly with deeply nested directory components.
Detection Strategies
- Inspect cpio archives received from untrusted sources by listing entries with cpio -tv under a resource-limited sandbox before extraction.
- Scan file transfer and email gateway telemetry for .cpio and .rpm payloads originating from untrusted senders.
- Correlate cpio process crashes with the archive being processed at the time of failure to identify malicious inputs.
Monitoring Recommendations
- Alert on SIGSEGV signals delivered to the cpio binary in host telemetry and audit logs.
- Monitor build systems, backup jobs, and package managers for repeated extraction failures.
- Track versions of the cpio package across the fleet and flag hosts running releases prior to commit 3cd514031371d8aeeaf2048aa10103e02831aaa9.
How to Mitigate CVE-2026-66485
Immediate Actions Required
- Update GNU cpio to a version that includes commit 3cd514031371d8aeeaf2048aa10103e02831aaa9 or the equivalent distribution patch.
- Avoid extracting cpio archives from untrusted sources until patched versions are deployed.
- Route automated extraction workflows through sandboxed environments with strict resource limits.
Patch Information
The upstream fix is available in the GNU cpio repository as commit 3cd514031371d8aeeaf2048aa10103e02831aaa9. Consult the GNU cpio repository for source-level details and rebuild instructions. Linux distributions typically ship backported patches through their standard package channels; apply vendor updates as they become available.
Workarounds
- Restrict cpio extraction to trusted archives only, and validate archive contents with cpio -tv prior to extraction.
- Enforce process stack limits with ulimit -s on service accounts that invoke cpio, so a crash is contained.
- Run extraction inside a container or chroot with dedicated resource limits to prevent operational impact on the host.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
