Detection
Monitor command-line arguments for rsync processes. Alert on execution of rsync with -X or --xattrs flags on affected versions.
CVE-2026-41035: rsync receiver use-after-free
Technical Analysis
Section titled “Technical Analysis”The vulnerability exists in receive_xattr where an untrusted length value is utilized during a qsort operation. This leads to a receiver use-after-free scenario. The issue is classified as CWE-130: Improper Handling of Length Parameter Inconsistency. The vulnerability specifically impacts configurations where extended attributes are enabled, which is a common setup in many Linux environments.
- Identify Usage: Confirm if rsync is executed with the
-Xor--xattrsflag in system automation or manual user scripts. - Version Check: Verify if the installed rsync version falls within the vulnerable range (3.0.1 - 3.4.1).
- Environment Audit: Assess exposure on non-Linux platforms, which are noted to be more widely vulnerable to this flaw.
Forensic Investigation
Section titled “Forensic Investigation”Forensic analysis should focus on identifying rsync execution patterns.
- Log Analysis: Search system logs for rsync commands utilizing
-Xor--xattrs. - Process Monitoring: Audit process execution history to identify malicious arguments or anomalous rsync invocations.
Detection and Mitigation
Section titled “Detection and Mitigation”Mitigation
Update rsync to a patched version beyond 3.4.1. If patching is not immediately feasible, disable the use of extended attributes (-X / --xattrs) in rsync configurations.