CVE-2026-88842 Overview
CVE-2026-88842 is a low-severity data integrity flaw in the BusyBox dpkg applet. The write_status_file() function fails to reset a field cursor between package stanzas. When an administrator removes two packages in a single dpkg invocation and the first stanza is larger than the second, the second package stanza can be dropped from the status file. The result is limited data corruption in the package status database. The weakness is tracked as [CWE-125] (Out-of-Bounds Read) and requires local access with user interaction to trigger.
Critical Impact
A locally executed dpkg removal of two packages can silently drop the second package entry from the status file, producing inconsistent package metadata.
Affected Products
- BusyBox dpkg applet (status file writer)
- Linux distributions and embedded images that ship BusyBox with the dpkg applet enabled
- Red Hat tracked instance referenced in Red Hat CVE-2026-88842
Discovery Timeline
- 2026-10-14 - CVE-2026-88842 published to NVD
- 2026-10-14 - Last updated in NVD database
Technical Details for CVE-2026-88842
Vulnerability Analysis
The flaw lives in BusyBox's dpkg applet, specifically in write_status_file(). This routine serializes in-memory package records back to the on-disk status file after an install or remove operation. The function uses a field cursor to track position while emitting stanza fields. The cursor is not reset between successive package stanzas written in the same invocation.
When two packages are removed in one dpkg call, the cursor retains state from the first stanza. If the first stanza is larger than the second, the writer treats part of the second stanza as already emitted and skips it. The second package record is dropped from the status file. Downstream tooling that reads the status file no longer sees the removed-but-recorded entry, leading to inconsistent package metadata.
Impact is limited to integrity of the status database. The issue does not grant code execution, elevate privileges, or expose confidential data. Exploitation requires an authorized local user to invoke dpkg with a specific two-package removal pattern, which aligns with the user-interaction requirement in the CVSS metric.
Root Cause
The root cause is missing state reinitialization in a loop. write_status_file() iterates over package stanzas but does not reset the per-stanza field cursor at the start of each iteration. This produces an out-of-bounds read of the stanza field table for subsequent packages, classified under [CWE-125].
Attack Vector
The attack vector is local and non-malicious in most scenarios. A user or script that removes two packages in a single dpkg invocation, where the first stanza is larger than the second, can trigger the corruption. See Red Hat Bug Report #2531355 for upstream discussion.
No public proof-of-concept exploit code is available. The vulnerability is described in prose only; refer to the vendor references for source-level detail.
Detection Methods for CVE-2026-88842
Indicators of Compromise
- Missing package entries in /var/lib/dpkg/status (or the BusyBox equivalent path) after a multi-package removal
- Discrepancy between installed binaries on disk and the package metadata reported by dpkg -l
- Package management operations that reference an unknown package immediately after a prior successful removal
Detection Strategies
- Compare the package status file against a known-good baseline after each dpkg operation on affected hosts
- Audit shell history and configuration management logs for dpkg invocations removing more than one package at a time
- Validate status file integrity in post-change checks within CI/CD pipelines that build or update BusyBox-based images
Monitoring Recommendations
- Monitor file writes to the BusyBox dpkg status file and alert on unexpected size reductions
- Track BusyBox version inventory across endpoints and embedded devices to prioritize patching
- Include package-manifest reconciliation in standard host integrity monitoring
How to Mitigate CVE-2026-88842
Immediate Actions Required
- Identify systems and images that use the BusyBox dpkg applet rather than the Debian dpkg binary
- Avoid removing multiple packages in a single BusyBox dpkg --remove invocation until patched; remove packages one at a time
- Back up /var/lib/dpkg/status before performing package removals on BusyBox-based systems
Patch Information
No fixed BusyBox version is listed in the published CVE record at the time of writing. Monitor the Red Hat CVE-2026-88842 advisory and upstream BusyBox release notes for the patched build. Apply distribution updates once vendors publish a fixed package.
Workarounds
- Issue one BusyBox dpkg --remove <package> command per package instead of batching removals
- Prefer the full Debian dpkg binary over the BusyBox applet on systems where package management correctness is critical
- After any batched removal, rebuild or reconcile the status file from a trusted source
# Safer removal pattern on unpatched BusyBox dpkg
cp /var/lib/dpkg/status /var/lib/dpkg/status.bak
busybox dpkg --remove package-one
busybox dpkg --remove package-two
diff /var/lib/dpkg/status.bak /var/lib/dpkg/status
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
