RLSA-2026:97867: Important: sos security, bug fix, and enhancement update
The sos package contains a set of utilities that gather information from system hardware, logs, and configuration files. The information can then be used for diagnostic purposes and debugging.
Security Fix(es):
sos: sos: path traversal in sos clean tar extraction via unvalidated symlink/hardlink targets leads to arbitrary file write (CVE-2026-79655)
Bug Fix(es) and Enhancement(s):
Hydra to GraphQL migration and sos upload [rhel-9.9.z] (JIRA:Rocky Linux-290949)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rocky-linux/sosto a version that resolves this vulnerability.Fixed in 0:4.11.2-7.el9_9 - Upgrade
Upgrade
rocky-linux/sos-auditto a version that resolves this vulnerability.Fixed in 0:4.11.2-7.el9_9
Event History
Frequently Asked Questions
Which systems should be reviewed for this issue?
Review Rocky Linux systems that have the sos or sos-audit packages installed. The advisory does not provide affected or fixed package versions, so package inventory should be correlated with the vendor advisory.
What is the potential impact if exploitation succeeds?
The flaw can allow arbitrary file writes through path traversal involving unvalidated symbolic-link or hard-link targets during sos clean tar extraction. The supplied severity vector indicates high impact to confidentiality, integrity, and availability.