Use-After-Free Vulnerability in Rsync Affects Linux and Non-Linux Systems

CVE-2026-41035

What is CVE-2026-41035?

In versions of rsync from 3.0.1 to 3.4.1, a vulnerability exists in the receive_xattr function that incorrectly manages an untrusted length value during a qsort operation. This flaw can lead to a use-after-free error when rsync is run with the -X (or --xattrs) option enabled. The vulnerability predominantly affects common configurations on Linux systems, but non-Linux platforms are also widely susceptible, making this a critical issue for users of the software across various environments.

References