RHSA-2026:97867: Important: sos security, bug fix, and enhancement update

Q: What operation must be involved for exploitation?

The issue is triggered during tar extraction performed by sos clean. Exploitation relies on unvalidated symbolic-link or hard-link targets in the archive extraction path.

Q: What impact can successful exploitation have?

Successful exploitation can lead to arbitrary file write through path traversal during sos clean tar extraction.

Q: Which platforms are explicitly listed for this update?

The advisory lists Red Hat Enterprise Linux for x86_64, ARM 64, IBM z Systems, and Power little endian, along with the redhat/sos and redhat/sos-audit software entries.

Q: Are there non-security changes included in the update?

Yes. The update also includes Hydra-to-GraphQL migration and sos upload changes for rhel-9.9.z.

Published Nov 10, 2026

Updated

Important: sos security, bug fix, and enhancement update

Other sources

The sos package contains a set of utilities that gather information from system hardware, logs, and configuration files. The information can then be used for diagnostic purposes and debugging.Security Fix(es): sos: sos: path traversal in sos clean tar extraction via unvalidated symlink/hardlink targets leads to arbitrary file write (CVE-2026-79655) Bug Fix(es) and Enhancement(s): Hydra to GraphQL migration and sos upload [rhel-9.9.z] (JIRA:RHEL-290949) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

— Red Hat

Affected Software

7 affected componentsFixes available

Red Hat Red Hat Enterprise Linux for x86_64

Red Hat Red Hat Enterprise Linux for ARM 64

Red Hat Red Hat Enterprise Linux for IBM z Systems

Red Hat Red Hat Enterprise Linux for Power, little endian

redhat/sos<4.11.2-7.el9_9

4.11.2-7.el9_9

redhat/sos<4.11.2-7.el9_9

4.11.2-7.el9_9

redhat/sos-audit<4.11.2-7.el9_9

4.11.2-7.el9_9

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade redhat/sos to a version that resolves this vulnerability.
Fixed in 4.11.2-7.el9_9
Upgrade
Upgrade redhat/sos-audit to a version that resolves this vulnerability.
Fixed in 4.11.2-7.el9_9

Event History

Nov 10, 2026

Advisory Published

via Red Hat·12:00 AM

Data Sourced

via Red Hat·12:00 AM

RemedyDescriptionAffected Software

Advisory Published

via Red Hat·09:26 PM

Data Sourced

via Red Hat·09:26 PM

Severity

Frequently Asked Questions

What operation must be involved for exploitation?

The issue is triggered during tar extraction performed by sos clean. Exploitation relies on unvalidated symbolic-link or hard-link targets in the archive extraction path.

What impact can successful exploitation have?

Successful exploitation can lead to arbitrary file write through path traversal during sos clean tar extraction.

Which platforms are explicitly listed for this update?

The advisory lists Red Hat Enterprise Linux for x86_64, ARM 64, IBM z Systems, and Power little endian, along with the redhat/sos and redhat/sos-audit software entries.

Are there non-security changes included in the update?

Yes. The update also includes Hydra-to-GraphQL migration and sos upload changes for rhel-9.9.z.

RHSA-2026:97867: Important: sos security, bug fix, and enhancement update

Other sources

Affected Software

Remediation

Event History

Frequently Asked Questions

What operation must be involved for exploitation?

What impact can successful exploitation have?

Which platforms are explicitly listed for this update?

Are there non-security changes included in the update?

Company

Resources

Contact

Frequently Asked Questions

What operation must be involved for exploitation?

What impact can successful exploitation have?

Which platforms are explicitly listed for this update?

Are there non-security changes included in the update?