QSN-8704-1: GNU cpio vulnerabilities
2026-08-31

Summary:
Several security issues were fixed in GNU cpio.

Details:
It was discovered that cpio incorrectly sanitized hard-link targets when
extracting tar archives in copy-in mode. If a user or automated system
were tricked into extracting a specially crafted tar archive, an attacker
could possibly use this issue to create hard links to files outside the
extraction directory, even when using the --no-absolute-filenames option.
(CVE-2026-66484)

It was discovered that cpio did not properly bound the stack memory
allocated for pathnames during archive extraction. If a user or automated
system were tricked into extracting a specially crafted cpio archive, an
attacker could possibly use this issue to cause cpio to crash, resulting
in a denial of service. (CVE-2026-66485)

It was discovered that cpio did not properly escape archive member names
when listing archive contents. If a user or automated system were tricked
into listing a specially crafted archive, an attacker could possibly use
this issue to inject misleading output or malicious terminal control
sequences. (CVE-2026-66486)

Affected QuantaStor releases:
  6.9.1.001 jammy: cpio 2.13+dfsg-7ubuntu0.1 (fixed in 2.13+dfsg-7ubuntu0.2)
  6.9.0.464 jammy: cpio 2.13+dfsg-7ubuntu0.1 (fixed in 2.13+dfsg-7ubuntu0.2)
  6.8.6.015 jammy: cpio 2.13+dfsg-7ubuntu0.1 (fixed in 2.13+dfsg-7ubuntu0.2)
  6.8.5.018 jammy: cpio 2.13+dfsg-7ubuntu0.1 (fixed in 2.13+dfsg-7ubuntu0.2)
  6.8.4.038 jammy: cpio 2.13+dfsg-7ubuntu0.1 (fixed in 2.13+dfsg-7ubuntu0.2)
  6.8.3.018 jammy: cpio 2.13+dfsg-7ubuntu0.1 (fixed in 2.13+dfsg-7ubuntu0.2)
  6.8.2.002 jammy: cpio 2.13+dfsg-7ubuntu0.1 (fixed in 2.13+dfsg-7ubuntu0.2)
  6.8.1.007 jammy: cpio 2.13+dfsg-7ubuntu0.1 (fixed in 2.13+dfsg-7ubuntu0.2)
  6.8.0.205 jammy: cpio 2.13+dfsg-7ubuntu0.1 (fixed in 2.13+dfsg-7ubuntu0.2)

CVEs: CVE-2026-66485, CVE-2026-66484, CVE-2026-66486

References:
  https://ubuntu.com/security/notices/USN-8704-1