Rsync patches 33 security vulnerabilities in critical update

---

Rsync 3.5.0 patched 33 CVEs including HIGH-severity privilege escalation and path traversal bugs. The release bumps the protocol to version 32 and hardens path resolution using `openat(O_PATH|O_NOFOLLOW)`. CVE-2026-53803 allowed symlinked output paths to write outside the transfer tree. CVE-2026-53784 let non-chrooted daemon modules escape the module root and serve arbitrary files.

Linux 7.2 reverted the DRM scheduler to FIFO after fair scheduling caused GPU freezes and 10 fps frame drops on AMD Radeon RX 9070 XT hardware.

In this issue:

• Rsync 3.5.0: 33 CVE fixes, protocol 32, daemon privilege escalation patches
• Linux 7.2: DRM scheduler FIFO revert after GPU freeze regressions
• Mold 2.42: multi-core performance gains, Android packed relocations, mimalloc v3 required
• QEMU 11.1: UFS 4.1 Write Booster and Host-Initiated Defragmentation emulation

---

Rsync 3.5.0 Patches 33 Security Vulnerabilities in Emergency Release

The Signal

Rsync 3.5.0 shipped 33 CVE fixes addressing path-traversal, symlink races, and memory corruption bugs.

What Changed

• Protocol version bumped to 32 to enforce security boundaries.
• CVE-2026-53802 (HIGH): symlinked operator-supplied input files leaked arbitrary file contents.
• CVE-2026-53803 (HIGH): symlinked output paths enabled privilege escalation via writes outside the tree.
• CVE-2026-53784 (HIGH): daemon module-root chdir escape under `use chroot = no` served files outside the module.
• CVE-2026-53799 (MEDIUM): receiver ACL/xattr application followed symlink races, allowing arbitrary ACL writes.
• CVE-2026-70461 through CVE-2026-70459 (HIGH): heap out-of-bounds writes in filter rules, hard-link slots, and argument parsing.
• Hardened path resolution: component-by-component walk using `openat(O_PATH|O_NOFOLLOW)`, trusted-owner checks on symlinks.
• Confined daemon operations: module chdir, merge-file opens, and backup/link operations anchored at module root.
• Bounded per-allocation sizes and hash-table chain walks to prevent resource exhaustion. Full CVE list

Operational Impact

Teams running rsync daemons must upgrade immediately. Non-chrooted daemon modules (`use chroot = no`) are vulnerable to arbitrary file read/write from authenticated clients. Symlink-based attacks allow privilege escalation if the daemon runs as root or can write to sensitive paths. Update both client and daemon binaries to 3.5.0. Protocol 32 is required for full path confinement; older clients will negotiate down to protocol 31 but lose some protections.

Watch For

Check daemon configs for `use chroot = no` and consider enabling chroot where feasible. Verify `refuse options` rules still work as expected; the 3.5.0 release tightened option validation.

---

Linux 7.2 Reverts DRM Scheduler to FIFO

The Signal

Linux 7.2 reverts the DRM scheduler to FIFO after fair scheduling caused GPU freezes and frame drops.

What Changed

• DRM scheduler switched from FIFO to fair policy during 7.2 merge window.
• Fair policy caused severe regressions: frame rates dropping to 10 fps, complete desktop freezes.
• AMD Radeon RX 9070 XT confirmed affected under sustained GPU saturation workloads.
• Tvrtko Ursulin submitted 20 revert patches days before 7.2 stable release.
• Affects AMDGPU, Intel, and other drivers using the DRM scheduler. https://www.phoronix.com/news/Linux-7.2-Reverting-DRM-Fair

Operational Impact

Teams running graphics-intensive workloads on 7.2-rc kernels should expect the fair scheduler to disappear. The regression triggered desktop freezes when GPU load hit 100%, particularly affecting gaming and rendering pipelines. FIFO remains the default scheduler policy; fair scheduling will return in a future release after the regression is resolved.

Watch For

Monitor DRM development for fixes to the fair scheduler implementation. Expect reintroduction in 7.3 or later once the performance degradation under sustained GPU load is addressed.

---

Mold 2.42 Linker Delivers Further Performance Gains for Build Pipelines

The Signal Mold 2.42 released with performance optimizations targeting large programs on multi-core systems.

What Changed

• Performance improvements described as "noticeably faster" for large programs on many-core machines.
• Added `--pack-dyn-relocs=android` and `android+relr` support for APS2 format dynamic relocations. https://github.com/rui314/mold/releases/tag/v2.42.0
• `--compress-debug-sections` now accepts compression levels like `zstd:9` or `zlib:6`.
• Fixed ICF bug where identical functions with different exception handlers were incorrectly merged.
• Now requires mimalloc v3; defaults to bundled 3.4.5 static build.

Operational Impact Teams linking large C++ projects on multi-core CI runners should see reduced link times. The ICF correctness fix prevents silent runtime errors from exception handler confusion. Projects using Mold must upgrade to mimalloc v3 or use bundled version. Android toolchain users gain smaller binaries through packed relocation support.

Watch For No benchmark data published with this release. Test link times on representative builds before rolling out.

---

QEMU 11.1 Adds UFS 4.1 Write Booster and Host-Initiated Defragmentation

The Signal

QEMU 11.1 ships with UFS 4.1 specification support, including Write Booster and Host-Initiated Defragmentation emulation.

What Changed

• QEMU 11.1 includes 3,200+ commits from 285 contributors released August 12, 2026.
• UFS Write Booster emulation enables write caching testing per UFS 4.1 spec.
• Host-Initiated Defragmentation (HID) emulation allows testing storage reorganization commands from host systems.
• RISC-V Zvfbfa extension support and big-endian emulation added for bare-metal development.
• Multiple new Arm CPU architectural features included across architecture emulation.

Operational Impact

Teams developing UFS storage drivers or testing mobile/embedded workloads can now validate UFS 4.1 features without physical hardware. The Write Booster emulation lets engineers test write-back caching behavior under load. RISC-V big-endian support fills a gap for networking and telecom firmware developers who need non-little-endian targets.

Watch For

Monitor KVM and libvirt updates that expose these UFS emulation features to management layers. Cloud providers may adopt this for storage performance testing environments.

---

Quick Reads

• Rsync — Version 3.5.0 patches 33 CVEs including path-traversal and privilege escalation vulnerabilities.
• Linux Kernel — Version 7.2 reverts DRM fair scheduler after GPU freezes and frame drops.
• Mold Linker — Version 2.42 delivers faster linking for large programs on multi-core systems.
• QEMU — Version 11.1 adds UFS 4.1 Write Booster and defragmentation emulation support.