CVE-2026-26158: 
CBL Mariner vulnerability analysis and mitigation

CVE-2026-26158 is a path traversal and arbitrary file modification vulnerability in BusyBox's tar extraction component (data_extract_all.c) that allows an attacker to modify files outside the intended extraction directory via maliciously crafted tar archives containing unvalidated hardlink or symlink entries. It affects BusyBox v1.36.1 and v1.37.0 (and likely earlier versions). Disclosed on February 11, 2026, it carries a CVSS v3.1 base score of 7.0 (High) per Feedly/NVD data, though the Red Hat Bugzilla report notes an internal CVSS estimate of 9.3 (Critical) (Red Hat Bugzilla, Red Hat Advisory).

The root cause is missing validation of the link_target path for hardlink and symlink entries during tar archive extraction in BusyBox's data_extract_all.c (CWE-73: External Control of File Name or Path; also associated with CWE-22: Path Traversal). Hardlink entries can reference absolute paths such as /etc/passwd, allowing writes to arbitrary locations on the filesystem without relying on relative path tricks, effectively bypassing existing path traversal mitigations. Symlink entries share the same root cause. Exploitation requires a user to extract a maliciously crafted archive, and the impact is significantly elevated when extraction is performed with elevated privileges (e.g., as root or via a privileged script) (Red Hat Bugzilla).

Successful exploitation allows an attacker to arbitrarily modify files outside the intended extraction directory, including critical system files such as /etc/passwd or /etc/sudoers. When the tar extraction is performed with elevated privileges, this can lead to full privilege escalation, enabling unauthorized root-level access. Confidentiality, integrity, and availability are all rated as High impact, as an attacker could overwrite system binaries, inject malicious configurations, or corrupt critical files (Red Hat Bugzilla, Feedly).

1. Craft malicious tar archive: Create a tar archive containing a hardlink or symlink entry whose link_target field points to an absolute path outside the intended extraction directory (e.g., /etc/passwd or /etc/cron.d/backdoor).
2. Social engineering / delivery: Deliver the malicious archive to a target system where a privileged user or automated process (e.g., a deployment script running as root) will extract it using BusyBox's tar utility.
3. Trigger extraction: Induce the privileged user or process to run a command such as busybox tar -xf malicious.tar -C /tmp/extract/, which triggers the unvalidated hardlink/symlink resolution.
4. File modification: BusyBox tar creates the hardlink or follows the symlink without validating the target path, writing attacker-controlled content to the absolute path (e.g., appending a new root user entry to /etc/passwd).
5. Privilege escalation: Leverage the modified system file to escalate privileges — for example, logging in as the newly injected root-equivalent user or executing a planted cron job (Red Hat Bugzilla).

• File System: Unexpected modifications to critical system files (e.g., /etc/passwd, /etc/shadow, /etc/sudoers, /etc/cron.d/*) with timestamps correlating to a tar extraction event; hardlinks or symlinks in extraction directories pointing to absolute system paths.
• Logs: System logs (/var/log/auth.log, /var/log/secure) showing new or unexpected user logins following a tar extraction; audit logs (auditd) recording writes to sensitive files by the tar or busybox process.
• Process: BusyBox tar process spawning with elevated privileges (root or sudo) extracting archives from untrusted or external sources; unexpected file ownership changes on system files.
• Network: Inbound delivery of tar archives from untrusted external sources to systems where privileged extraction scripts are known to run.

Red Hat has released a patched BusyBox package (busybox-1.37.0-7.2.hum1) for Red Hat Hardened Images as part of security advisory RHSA-2026:13831, published May 5, 2026 (Red Hat Advisory). SUSE has also issued security updates (SUSE-2026:0758-1, SUSE-2026:0759-1, SUSE-2026:0872) addressing this vulnerability (Linux Security SUSE). As a workaround, avoid extracting tar archives from untrusted sources with elevated privileges, and use --no-overwrite-dir or equivalent flags where supported. Organizations should audit scripts and automation that extract archives as root and restrict the use of BusyBox tar in privileged contexts until patched versions are deployed.

OpenSUSE noted the BusyBox fix in its February 2026 Tumbleweed monthly update (OpenSUSE News). Dell issued a security advisory (DSA-2026-158) addressing this and related vulnerabilities in PowerProtect Data Manager (Dell Advisory). No significant social media discussion or notable independent researcher commentary has been identified beyond standard vulnerability tracking and vendor patch announcements.