Security fix for CVE-2026-11940: a symlink escape vulnerability
via tarfile hardlink-extraction fallback. The new backport patch
(00491-cve-2026-11940.patch) adds a filter check on the
hardlink's target name before performing the fallback copy,
preventing extraction of symlinks that point outside the
destination directory.
CVE: CVE-2026-11940
Upstream patches:
- 27dd970bf6.patch
Resolves: RHEL-227194
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
