# ALSA-2026:67463: Security update for 3 packages

ALSA-2026:67463, released September 14, 2026, fixes 21 CVEs across 3 products. None of them is reported as exploited. Patch Radar priority: Urgent.

- Web page: https://patchblox.com/security/fix/linux/alsa-2026-67463
- Platform: Linux
- Released: Sep 14, 2026
- Priority: Urgent (Closes CVE-2026-53791, rated Critical)
- CVEs: 21, exploited: 0, on CISA KEV: 0
- Vendor advisory: https://osv.dev/vulnerability/ALSA-2026:67463

## Applies to

| Product | Release | Fixed in |
|---|---|---|
| [rsync](https://patchblox.com/security/data/product/linux/rsync.md) | almalinux 10 | 3.5.0-3.el10_2 |
| [rsync-daemon](https://patchblox.com/security/data/product/linux/rsync-daemon.md) | almalinux 10 | 3.5.0-3.el10_2 |
| [rsync-rrsync](https://patchblox.com/security/data/product/linux/rsync-rrsync.md) | almalinux 10 | 3.5.0-3.el10_2 |

## CVEs this fix closes

| CVE | Priority | Title | CVSS | EPSS | Exploitation |
|---|---|---|---:|---:|---|
| [CVE-2026-53791](https://patchblox.com/security/data/cve/CVE-2026-53791.md) | Urgent | rsync < 3.5.0 Daemon IP Spoofing via PROXY Protocol Header | 9.1 | 0.0050 |  |
| [CVE-2026-70452](https://patchblox.com/security/data/cve/CVE-2026-70452.md) | Urgent | rsync 3.1.0 < 3.5.0 Access Control Bypass via DNS Resolution Failure | 8.2 | 0.0046 |  |
| [CVE-2026-70460](https://patchblox.com/security/data/cve/CVE-2026-70460.md) | Urgent | rsync 2.3.3 < 3.5.0 Path Traversal via --partial-dir/--backup-dir Symlink | 8.2 | 0.0045 |  |
| [CVE-2026-70464](https://patchblox.com/security/data/cve/CVE-2026-70464.md) | High | rsync 2.0.0 < 3.5.0 Connection Slot Exhaustion DoS via Handshake Stall | 8.2 | 0.0064 |  |
| [CVE-2026-53790](https://patchblox.com/security/data/cve/CVE-2026-53790.md) | High | rsync < 3.5.0 Command Injection via Multiple Code Paths | 8.2 | 0.0063 |  |
| [CVE-2026-70461](https://patchblox.com/security/data/cve/CVE-2026-70461.md) | High | rsync 3.2.5 < 3.5.0 Heap Out-of-Bounds Write via files-from Entry | 8.2 | 0.0057 |  |
| [CVE-2026-70455](https://patchblox.com/security/data/cve/CVE-2026-70455.md) | High | rsync 3.4.2 < 3.5.0 DoS via --zt Zstandard Compression Thread Exhaustion | 8.2 | 0.0057 |  |
| [CVE-2026-70453](https://patchblox.com/security/data/cve/CVE-2026-70453.md) | High | rsync < 3.5.0 Algorithmic Complexity DoS via hash_search() | 8.2 | 0.0053 |  |
| [CVE-2026-53795](https://patchblox.com/security/data/cve/CVE-2026-53795.md) | High | rsync < 3.5.0 Arbitrary File Write via --temp-dir/--link-dest | 8.2 | 0.0040 |  |
| [CVE-2026-70456](https://patchblox.com/security/data/cve/CVE-2026-70456.md) | High | rsync 3.0.1 < 3.5.0 Heap Out-of-Bounds Write via read_args() | 8.2 | 0.0040 |  |
| [CVE-2026-70458](https://patchblox.com/security/data/cve/CVE-2026-70458.md) | High | rsync 3.0.0 < 3.5.0 Out-of-Bounds Write via FLAG_HLINKED Handling | 8.2 | 0.0040 |  |
| [CVE-2026-53793](https://patchblox.com/security/data/cve/CVE-2026-53793.md) | High | rsync < 3.5.0 Path Confinement Bypass via /./ Boundary Marker in Chroot Mode | 8.2 | 0.0039 |  |
| [CVE-2026-70457](https://patchblox.com/security/data/cve/CVE-2026-70457.md) | High | rsync 3.2.3 < 3.5.0 Out-of-Bounds Write via parse_size_arg() | 8.2 | 0.0038 |  |
| [CVE-2026-53783](https://patchblox.com/security/data/cve/CVE-2026-53783.md) | High | rsync < 3.5.0 TOCTOU Race Condition Directory Escape via rrsync | 8.2 | 0.0037 |  |
| [CVE-2026-70463](https://patchblox.com/security/data/cve/CVE-2026-70463.md) | High | rsync: rsync 3.1.0 before 3.5.0 contains an authorization bypass in auth users directive parsing | 8.2 | 0.0036 |  |
| [CVE-2026-53789](https://patchblox.com/security/data/cve/CVE-2026-53789.md) | High | rsync < 3.5.0 Arbitrary File Deletion via Malicious File List | 8.2 | 0.0036 |  |
| [CVE-2026-53784](https://patchblox.com/security/data/cve/CVE-2026-53784.md) | High | rsync < 3.5.0 Path Traversal via Symlink Module Root | 8.2 | 0.0024 |  |
| [CVE-2026-53802](https://patchblox.com/security/data/cve/CVE-2026-53802.md) | High | rsync < 3.5.0 Arbitrary File Read via Symlink Following | 8.2 | 0.0024 |  |
| [CVE-2026-53803](https://patchblox.com/security/data/cve/CVE-2026-53803.md) | High | rsync < 3.5.0 Symlink Following Arbitrary File Overwrite | 8.2 | 0.0023 |  |
| [CVE-2026-53785](https://patchblox.com/security/data/cve/CVE-2026-53785.md) | High | rsync < 3.5.0 Path Traversal Write Escape via --relative Mode | 8.2 | 0.0019 |  |
| [CVE-2026-70454](https://patchblox.com/security/data/cve/CVE-2026-70454.md) | High | rsync < 3.5.0 TLS Certificate Validation Bypass via SSL/OpenSSL Mode | 8.2 | 0.0019 |  |

---

Data as of 2026-11-07T12:40:37Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo