- CVE-2026-53786: strip the module dir back off a --filter merge file path before the daemon_filter_list check so an anchored module-relative daemon rule matches and a hidden merge file cannot be pulled in - CVE-2026-53795: confine each side of do_rename_at() and do_link_at() independently so an absolute --temp-dir or --link-dest cannot switch off confinement and redirect the final rename out of the destination tree - CVE-2026-53802: route the secrets file, --password-file, the filter and merge files and --files-from through open_no_attacker_symlinks() and fstat the descriptor so a planted symlink cannot leak a root-readable file