xattrs security

The xattrs security tag covers discussions about vulnerabilities and best practices related to extended attributes (xattrs) in file synchronization and storage systems, particularly in cross-platform environments involving Windows. A key topic is CVE-2026-41035, a use-after-free bug in rsync versions 3.0.1 through 3.4.1 triggered when processing extended attributes with the -X or --xattrs flag. While not a Windows kernel issue, the vulnerability affects Windows users through WSL, Git-for-Windows tooling, NAS appliances, and backup scripts that rely on rsync. The tag emphasizes that metadata handling via xattrs has become critical infrastructure in modern IT estates, requiring careful patching and configuration management.