RLSA-2026:98076: Important: sos security, bug fix, and enhancement update
The sos package contains a set of utilities that gather information from system hardware, logs, and configuration files. The information can then be used for diagnostic purposes and debugging.
Security Fix(es):
sos: sos: path traversal in sos clean tar extraction via unvalidated symlink/hardlink targets leads to arbitrary file write (CVE-2026-79655)
Bug Fix(es) and Enhancement(s):
Hydra to GraphQL migration and sos upload (JIRA:Rocky Linux-290940)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rocky-linux/sosto a version that resolves this vulnerability.Fixed in 0:4.11.2-7.el10_3
Event History
Frequently Asked Questions
What must an attacker do to exploit this issue?
The attacker must cause sos clean to extract a tar archive containing symlink or hardlink targets that have not been validated. Exploitation also requires user interaction, as reflected by the UI:R vector.
What is the impact if exploitation succeeds?
Successful exploitation can lead to arbitrary file writes through path traversal during tar extraction. The advisory rates confidentiality, integrity, and availability impacts as high.
Is this remotely exploitable without access to the affected system?
The CVSS vector lists local attack vector (AV:L), so the issue is not described as remotely exploitable over the network. It also lists no privileges required (PR:N), but requires user interaction.