Brief Summary: Rsync CVE-2026-41035 Use After Free in Extended Attribute Processing

Introduction

A use-after-free condition in rsync's extended attribute handling lets a malicious sender corrupt the memory of any receiver process that has extended attributes enabled. Every rsync version from 3.0.1 through 3.4.1 is affected. The practical exposure is significant. Countless backup pipelines, mirror infrastructure, and deployment workflows run on rsync, and the vulnerable configuration needs only one commonly used flag (-X or --xattrs).

Technical Information

Root Cause: Wire Count vs. Actual Count in qsort

The vulnerability lives in the receive_xattr function in xattrs.c. When rsync receives extended attributes from a remote sender, it reads a count value directly from the wire protocol. It allocates memory based on this count and starts filling an array of attribute entries. Not every received attribute survives intake, though. Namespace rules and user-defined filters can discard some of them, and when that happens the array holds fewer valid entries than the wire-supplied count.

The bug is in the qsort call that follows. It passes the original wire count as the element count instead of the number of attributes that were actually accepted. When attributes have been filtered out, the trailing slots in the array hold either uninitialized memory or stale data left over from previously processed files. qsort reads, compares, and rearranges these stale entries as if they were valid, and inserts them into the active attribute list.

The flaw is classified under CWE-130: Improper Handling of Length Parameter Inconsistency.

Exploitation Primitives

Once stale entries are sorted into the active list, they become dangling pointers to heap allocations that have already been freed. The vulnerability reporter identified several concrete exploitation primitives available on stock rsync builds:

Read after free: Checksum comparisons and name copying dereference the stale pointers, which lets an attacker influence control flow based on freed heap contents.
Double free: Cleanup frees the stale pointers more than once and corrupts the heap allocator's internal state.
Information disclosure: When the receiver writes stale attribute values as extended attributes, heap layout information can leak to the filesystem.
Denial of service: The memory corruption reliably crashes the receiver process with a segmentation fault. This is the most straightforward and reproducible outcome.

Attack Flow

To exploit this vulnerability, an attacker would act as a malicious rsync sender or compromise an existing one. The attack proceeds as follows:

The victim starts or accepts an rsync transfer with the -X (extended attributes) flag enabled.
The malicious sender crafts a file list with extended attributes designed to trigger filtering on the receiver. It sets the wire count higher than the number of attributes the receiver will accept.
The receiver's receive_xattr function processes the incoming attributes and filters some out, but keeps the original wire count.
The qsort call runs over the full array, stale slots included, and promotes dangling pointers into the active attribute list.
Later operations on these dangling pointers produce the exploitation primitives described above.

Platform Vulnerability Matrix

The exact trigger conditions depend heavily on the operating system and rsync configuration:

Operating System	Configuration	Status	Reason
Linux	Receiver running with fake super	Vulnerable	Non-user attributes are prefixed and sorted
Linux	Non-root receiver with attribute filter	Vulnerable	Filtered attributes trigger the sorting logic
Linux	Root receiver without fake super	Not Vulnerable	Attributes are accepted without filtering, so the count mismatch does not occur
FreeBSD and macOS	Any receiver with extended attributes	Vulnerable	Sorting is unconditionally enabled regardless of privilege level

On Linux, exposure depends heavily on the exact command-line flags in use. Non-Linux platforms, particularly FreeBSD and macOS, are more broadly exposed, because rsync always takes the vulnerable sorting path there when extended attributes are requested.

Proposed Source Fix

The vulnerability reporter proposed a minimal fix that corrects the element count passed to qsort:

if (need_sort && temp_xattr.count > 1)
    qsort(temp_xattr.items, temp_xattr.count, sizeof (rsync_xa), rsync_xal_compare_names);

With this change, qsort operates only on the number of attributes actually accepted (temp_xattr.count) instead of the wire-supplied value, so stale data cannot be sorted into the active list.

Affected Systems and Versions

The vulnerability affects rsync versions 3.0.1 through 3.4.1, as well as the development head at the time of disclosure. Exploitation requires the victim to run rsync with the -X or --xattrs flag.

Specific vulnerable configurations include:

Linux: Receivers running with --fake-super, or non-root receivers using attribute filters. Root receivers without fake super are not affected.
FreeBSD: All receivers using extended attributes, regardless of privilege level.
macOS: All receivers using extended attributes, regardless of privilege level.

Vendor Security History

The rsync project fixed a large batch of security issues in January 2025 with version 3.4.0, which it explicitly labeled a critical security release. That update resolved multiple heap buffer overflows and information leak vulnerabilities. Given the project's record of responding to security disclosures, and the recent return of original author Andrew Tridgell to maintainer duties, a formal patch for CVE-2026-41035 will likely follow soon.

CVE Analysis

Experimental AI-Generated Content

Introduction

Technical Information