GNU cpio CVE-2026-66484

The upstream fix is commit e2b9cbdd3354d2b1569b7390d1bc15c1930559ad in the GNU cpio repository at https://git.savannah.gnu.org/cgit/cpio.git; no tagged release incorporating this fix has been confirmed at time of analysis, so the primary action is to monitor Linux distribution security channels (RHEL/CentOS, Debian, Ubuntu, Fedora errata) for updated cpio packages and apply them as part of routine patching. As an interim compensating control for environments processing untrusted archives, replace cpio-based extraction with GNU tar (tar -x) invoked inside a chroot or container to enforce filesystem namespace isolation - this removes the entire vulnerable code path at the cost of tooling changes in existing scripts. Alternatively, post-extraction audits using find <destdir> -type f -links +1 can detect unexpected hard links created during extraction, providing a detective control that identifies exploitation attempts without preventing them. Avoid extracting tar archives from untrusted sources using cpio until a patched package is available from your distribution vendor. The CERT-PL advisory at https://cert.pl/en/posts/2026/08/CVE-2026-66484 should be monitored for patched version announcements.