CVE-2026-70458 is a struct layout regression, not a conventional code bug. The F_SUM field was removed or relocated during rsync's 2.x to 3.x refactoring, but the FLAG_HLINKED processing path still references it — creating an out-of-bounds write that triggers only under a specific combination: HLINK_BUMP processing active while hard-link preservation is disabled. This condition has been exercised in production since approximately rsync 3.0.0, roughly 12-15 years of silent exposure.
The critical insight for defenders: this doesn't behave like a typical buffer overflow that crashes visibly. The out-of-bounds write likely hits heap padding or adjacent objects that don't cause immediate failure. rsync exits with code zero, the sync completes, and data propagates to the destination as if nothing happened. Your backups may have been serving corrupted data for years without any detection — that's the real threat model.
Audit your rsync invocations for configurations that disable hard-link preservation (--no-hard-links, --no-links, or equivalent) while processing source trees that previously contained hard links. If you cannot determine this with confidence, treat any rsync run against legacy or unknown source filesystems as potentially corrupted. The fix is patching, but the remediation challenge is deeper: you must assess whether data already synchronized under the vulnerable code path maintains integrity. Re-running rsync with --checksum on existing backups is the only reliable verification, though costly for large datasets.
Prioritize patching in environments where rsync runs with elevated privileges — daemon mode, backup scripts, container entrypoints, Ansible/Terraform provisioning. An attacker who controls file lists processed by rsync (even without filesystem write access) can trigger the corruption. The EPSS score of 0.00396 underestimates this risk because automated scanners don't detect struct layout mismatches; the vulnerability was invisible to every standard detection tool for over a decade.