Public bug reported: With tar 1.35+dfsg-3ubuntu0.2, passing an absolute directory to --one-top-level causes extraction to fail with 'Invalid cross-device link' (EXDEV). This happens regardless of the tarball, and whether it has any hardlinks at all.
To replicate, using the make 4.4.1 tarball from https://www.gnu.org/software/make/ ``` $ tar -xf make-4.4.1.tar.gz --one-top-level=$(pwd)/make tar: /home/aria/make/make-4.4.1: Cannot mkdir: Invalid cross-device link tar: /home/aria/make/make-4.4.1/ABOUT-NLS: Cannot open: Invalid cross-device link tar: /home/aria/make/make-4.4.1/AUTHORS: Cannot open: Invalid cross-device link tar: /home/aria/make/make-4.4.1/Basic.mk: Cannot open: Invalid cross-device link tar: /home/aria/make/make-4.4.1/COPYING: Cannot open: Invalid cross-device link tar: /home/aria/make/make-4.4.1/ChangeLog: Cannot open: Invalid cross-device link tar: /home/aria/make/make-4.4.1/INSTALL: Cannot open: Invalid cross-device link tar: /home/aria/make/make-4.4.1/Makefile.am: Cannot open: Invalid cross-device link tar: /home/aria/make/make-4.4.1/Makefile.in: Cannot open: Invalid cross-device link ...u # Works as expected $ tar -xf make-4.4.1.tar.gz --one-top-level=./make ``` I suspect this is due to the mitigation for CVE-2026-5704. It doesn't seem to be present in tar 1.35+dfsg-3build1. In some cases, this can be worked around by using `-C` instead of `--one-top-level=` Version info: ``` aria@benzar:~$ lsb_release -rd No LSB modules are available. Description: Ubuntu 24.04.4 LTS Release: 24.04 aria@benzar:~$ sudo apt-cache policy tar tar: Installed: 1.35+dfsg-3ubuntu0.2 Candidate: 1.35+dfsg-3ubuntu0.2 Version table: *** 1.35+dfsg-3ubuntu0.2 500 500 http://gb.archive.ubuntu.com/ubuntu noble-updates/main amd64 Packages 500 http://security.ubuntu.com/ubuntu noble-security/main amd64 Packages 100 /var/lib/dpkg/status 1.35+dfsg-3build1 500 500 http://gb.archive.ubuntu.com/ubuntu noble/main amd64 Packages ``` ** Affects: tar (Ubuntu) Importance: Undecided Status: New -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2160696 Title: Extraction fails when passing absolute directory to --one-top-level To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/tar/+bug/2160696/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
