CVE-2026-79655 Overview
CVE-2026-79655 is a path traversal vulnerability in sos clean, a utility in the sos diagnostic reporting package used across Red Hat and other Linux distributions. The flaw allows a local attacker to create or overwrite arbitrary files on the target system. The vulnerability stems from improper validation of symbolic link and hard link targets during tar archive extraction. Because sos clean frequently runs as root, successful exploitation can lead to privilege escalation and full system compromise.
Critical Impact
A local attacker who supplies a crafted tar archive to sos clean can write files anywhere on the filesystem with root privileges, resulting in complete host compromise.
Affected Products
- sos package (Red Hat ecosystem and downstream distributions)
- sos clean utility on systems where the tool runs with elevated privileges
- Linux distributions that ship the sosreport/sos tooling
Discovery Timeline
- 2026-08-25 - CVE-2026-79655 published to the National Vulnerability Database (NVD)
- 2026-08-25 - Last updated in NVD database
Technical Details for CVE-2026-79655
Vulnerability Analysis
The vulnerability is a link-following weakness classified as [CWE-59] (Improper Link Resolution Before File Access). When sos clean extracts a tar archive, it does not validate that symbolic link and hard link targets remain within the intended extraction directory. An attacker who controls the contents of a tar file processed by sos clean can embed links pointing to arbitrary absolute paths outside the extraction root.
During extraction, subsequent archive entries written through those links land at attacker-chosen destinations on the filesystem. Because sos clean is typically invoked by an administrator or automation running as root, the resulting writes inherit root privileges. Attackers can overwrite security-sensitive files such as /etc/passwd, /etc/shadow, /etc/sudoers.d/, systemd unit files, or cron jobs to achieve persistent local privilege escalation.
Exploitation requires local access and user interaction, specifically an administrator running sos clean against a malicious archive. No authentication is required for the attacker to plant the archive on the system.
Root Cause
The root cause is missing validation of link targets during tar extraction inside sos clean. The extraction logic honors symlink and hardlink entries without confirming that the resolved target path stays inside the destination directory. Safe tar extraction requires resolving each link target and rejecting entries whose canonical path escapes the extraction root.
Attack Vector
An attacker prepares a tar archive containing a symlink or hardlink entry whose target is an absolute path such as /etc/cron.d/anyfile, followed by a regular file entry that writes through that link. When an administrator invokes sos clean on the archive, extraction follows the attacker-controlled link and writes the payload to the arbitrary location with the privileges of the sos clean process.
For a full technical description and patch discussion, see the Red Hat CVE-2026-79655 Advisory, the Red Hat Bugzilla Report #2523363, the GitHub Issue #4460 Discussion, and the corresponding GitHub Pull Request #4461.
Detection Methods for CVE-2026-79655
Indicators of Compromise
- Unexpected symlinks or hardlinks in directories used as sos clean extraction targets, particularly links pointing to absolute paths outside the working directory.
- Recent modifications to sensitive files such as /etc/passwd, /etc/shadow, /etc/sudoers, /etc/sudoers.d/*, /etc/cron.d/*, or systemd unit files coinciding with sos clean invocations.
- Tar archives of unknown origin staged in administrator home directories or shared paths before sos clean execution.
Detection Strategies
- Audit process execution logs for invocations of sos clean and correlate with file write events outside the expected extraction directory.
- Enable and review Linux auditd rules that watch for writes to security-sensitive paths by processes named sos or python3 running the sos module.
- Inspect tar archives passed to sos clean with tar -tvf before extraction to enumerate symlink and hardlink entries and their targets.
Monitoring Recommendations
- Forward auditd, execve, and file integrity monitoring telemetry to a centralized analytics platform for retrospective hunting after any confirmed sos package exposure.
- Alert on any file creation under /etc, /root, /usr/lib/systemd/, or /var/spool/cron/ whose parent process ancestry includes sos clean.
- Track package inventory to identify hosts still running unpatched versions of sos.
How to Mitigate CVE-2026-79655
Immediate Actions Required
- Update the sos package to the fixed version published by your Linux distribution as soon as it is available.
- Do not run sos clean against tar archives received from untrusted sources or produced on untrusted systems.
- Restrict access to accounts and automation that invoke sos clean with root privileges.
Patch Information
The upstream fix is tracked in GitHub Pull Request #4461 against the sosreport/sos project, with discussion in GitHub Issue #4460. Distribution-specific package updates are coordinated through the Red Hat CVE-2026-79655 Advisory and Red Hat Bugzilla Report #2523363. Apply vendor updates through your standard package manager once released.
Workarounds
- Run sos clean only against archives generated locally by trusted sos report runs on the same host.
- Extract untrusted tar archives manually in a disposable directory using tools that reject unsafe link entries, and inspect contents before passing them to sos clean.
- Where feasible, execute sos clean inside an unprivileged container or chroot to contain the impact of arbitrary file writes.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
