CVE-2026-90954 is a symlink handling flaw in BusyBox's dpkg-deb applet. A crafted .deb archive can write a file outside the directory you extract into. NVD scores it High (7.8). Red Hat's tracker cites no fixing commit, so avoid extracting untrusted .deb files with BusyBox.
What's affected
Red Hat's CVE page and its Bugzilla entry describe the flaw in BusyBox's dpkg-deb extraction. The reporter states the bug was introduced by a commit from 22 May 2018 and affects versions 1_29_0 through current master. The tracker adds that no fixing commit exists at the time of its last update. We could not confirm a fixed version, so check the BusyBox project and your distribution for updates.
Red Hat says its own product impact analysis is pending. Fedora ships BusyBox with the dpkg applets enabled and is confirmed affected, and RHEL does not ship BusyBox as a standard package. The reporter reproduced the flaw on Fedora, Debian 13 and Ubuntu 24.04 builds.
The weakness is CWE-59, link following. The record's vector is CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. Red Hat's tracker lists severity High, so the sources agree.
How to check if you're exposed
Find out whether BusyBox on your system has the applet enabled:
busybox --list | grep dpkg
If dpkg-deb appears, the applet is present. Then search your build scripts, Dockerfiles and firmware tooling for calls that use BusyBox to unpack .deb files. Red Hat names cross-platform build environments, container image construction and firmware unpacking as the places this is likely to occur.
To inspect a .deb before handling it, list its members:
ar t package.deb
A legitimate .deb contains exactly one data archive, per Red Hat's mitigation text. More than one is a reason to stop.
Paste a lockfile or SBOM into the free in-browser dependency scan to see whether this package is in your tree, including as a transitive dependency. Safeguard's reachability analysis can then show whether your code actually calls the affected path, which helps you order the work.
What to do now
- Do not use BusyBox dpkg-deb to extract .deb files from sources you do not trust.
- Use Debian's reference dpkg-deb for extraction. Red Hat says it treats the extraction root as a boundary and is not affected.
- If you must use BusyBox, check each archive for multiple data members before extracting.
- Extract inside a throwaway container or directory with no write access to anything valuable.
- Watch the BusyBox project and your distribution's tracker for a fix, and update when one ships.
Why it matters
BusyBox defers symlinks that point outside the extraction directory until every archive member has been written, so that no later member can pass through them. The Red Hat write-up explains that the ar handler used for .deb files flushes those deferred symlinks after each member instead of once at the end, unlike the tar, cpio and unzip handlers. That breaks the safeguard: a link held back from the first member becomes live before the second is processed.
The lesson is that a protection which depends on ordering is easy to break when one code path does things differently from its siblings. The attack needs a user to extract a crafted file, so it is a local, user-triggered risk. The KEV flag in the record is false and no source reports exploitation.
Try it yourself
Many BusyBox copies live inside container images. This demo shows how an image scan lists the components your images really ship.
Click through it at your own pace, or open it full screen.
Quick check
Is there a patched BusyBox release?
We could not confirm one. Red Hat's tracker says no fixing commit exists, so check the project and your distribution.
Does this affect RPM-based systems?
Red Hat says RPM systems do not normally process .deb files, which limits exposure, though cross-platform build tooling can use them.
Sources
Last reviewed: 18 October 2026.
