CVE-2026-5704: 
Rocky Linux vulnerability analysis and mitigation

CVE-2026-5704 is a hidden file injection vulnerability in GNU tar that allows a remote attacker to craft a malicious archive causing files to be injected onto a target system without appearing in pre-extraction listing output. The flaw was reported by Guillermo de Angel on March 18, 2026, and publicly disclosed on April 6, 2026, when Red Hat assigned the CVE. It affects GNU tar 1.35 (and likely earlier versions) and is also tracked as impacting Red Hat Enterprise Linux 6.0 through 10.0 and IBM Business Automation Insights. The CVSS v3.1 base score is 5.5 (Medium) per Red Hat's assessment, with an integrity-only impact (Red Hat CVE, Red Hat Bugzilla, GitHub Advisory).

The root cause is a behavioral inconsistency in GNU tar between its listing (tar -t) and extraction (tar -x) operations, classified as CWE-434 (Unrestricted Upload of File with Dangerous Type). When a tar archive contains non-data-bearing typeflags (symlink '2', chardev '3', blockdev '4', FIFO '6') with a non-zero size field, tar -t respects the size field and skips the data blocks (hiding them from the listing), while tar -x ignores the size field and parses those data blocks as additional file headers — creating files on disk that were never shown in the listing. An attacker can craft an archive under 3 KB with no special privileges; the only precondition is that a victim user extracts the archive using GNU tar. A patch was committed to the GNU tar repository by Paul Eggert at cgit.git.savannah.gnu.org (commit b8d8a61b25588caca4efaf9bdd2e3f1a49da77e3) (Openwall oss-sec, Red Hat Bugzilla).

Successful exploitation allows an attacker to inject arbitrary, fully attacker-controlled files onto a target system that bypass pre-extraction inspection mechanisms such as tar -t or equivalent API calls. The impact is limited to integrity — there is no confidentiality or availability impact — but injected files could include malicious scripts, configuration overrides, or binaries that execute in subsequent build or deployment steps. A concrete RCE chain has been demonstrated via PAX sparse archive stream desynchronization, where injected files placed in build directories (e.g., .cache, Makefiles) could trigger code execution when make is subsequently run (Openwall oss-sec, Red Hat Bugzilla).

Multiple proof-of-concept exploits are publicly available, including a standalone Python 3 PoC generator and four minimal crafted archives (one per affected typeflag) shared by the original reporter, as well as detailed reproduction steps on the Openwall oss-security mailing list and Red Hat Bugzilla. There is no confirmed evidence of in-the-wild exploitation at this time, and the CVE is not listed in the CISA KEV catalog. The EPSS score is approximately 0.025–0.032%, indicating a low near-term exploitation probability. No specific threat actor attribution has been reported (Red Hat Bugzilla, Openwall oss-sec, GitHub Advisory).

1. Craft the malicious archive: Using a Python 3 script (no external dependencies), construct a tar archive containing a carrier entry with a non-data-bearing typeflag (e.g., chardev '3') and a non-zero size field. Embed a hidden file header and content in the data region of that carrier entry. The resulting archive is under 3 KB.
2. Deliver the archive: Distribute the crafted archive to the target system — e.g., via a supply chain attack, a malicious download, or a compromised artifact repository — targeting any workflow that performs pre-extraction inspection.
3. Victim performs pre-extraction inspection: The victim runs tar -tf crafted.tar (or an equivalent API call). The listing output shows only the expected entries (e.g., carrier_entry, marker.txt); the injected file is not visible.
4. Victim extracts the archive: The victim runs tar -xf crafted.tar -C /target/dir. GNU tar's extraction path ignores the size field on the non-data typeflag and parses the embedded data blocks as additional headers, writing the injected file (e.g., injected.txt or a malicious script) to disk.
5. Achieve objective: The injected file is now present on disk without having appeared in the pre-extraction listing. For an RCE chain, the attacker places a malicious file (e.g., a crafted .cache or Makefile fragment) in a build directory, which executes when the build system (e.g., make) is subsequently invoked (Red Hat Bugzilla, Openwall oss-sec, Openwall oss-sec Apr 12).

• File System: Unexpected files present in extraction directories that do not correspond to entries shown by tar -tf on the same archive; files with unusual names (e.g., .cache, hidden dotfiles, unexpected Makefile fragments) appearing after tar extraction; file timestamps inconsistent with the rest of the extracted archive contents.
• Logs: Audit logs or file integrity monitoring alerts showing new file creation events in directories where tar extraction occurred, for files not listed in pre-extraction inventory checks.
• Process: Unexpected child processes (e.g., make, shell scripts) spawned shortly after tar extraction in build or deployment pipelines, particularly if those processes were not part of the expected workflow.
• Network: Outbound connections from build servers or deployment systems to unknown external hosts following tar extraction, which may indicate execution of an injected payload (Red Hat Bugzilla, Openwall oss-sec).

The upstream fix is a patch committed to the GNU tar repository by Paul Eggert (commit b8d8a61b25588caca4efaf9bdd2e3f1a49da77e3); users should update to a patched version of GNU tar once distributed by their OS vendor. Red Hat has issued patches for affected RHEL versions (6.0–10.0), and IBM has addressed the vulnerability in IBM Business Automation Insights iFixes for May 2026. As a workaround until patching is possible: restrict tar archive sources to trusted origins only, implement post-extraction file verification (e.g., comparing extracted file lists against a trusted manifest), and consider using bsdtar (which handles this case consistently) for pre-extraction inspection (Openwall oss-sec, Red Hat CVE, IBM Advisory).

The vulnerability was discussed on the Openwall oss-security mailing list in April 2026, where Alan Coopersmith (Oracle Solaris Engineering) forwarded the original disclosure and noted the upstream patch. Collin Funk commented on the thread, noting that the original report's phrasing suggested it may have been AI-assisted (a common LLM hallucination pattern of writing as if sending a private message on a public list), though he acknowledged the underlying bug was genuine. The Yocto Project security mailing list also tracked the issue. No major media coverage or significant social media amplification has been observed beyond standard CVE tracking feeds (Openwall oss-sec, Openwall oss-sec reply).