- CVE-2026-53799: pin each received entry with a per-component O_NOFOLLOW walk and apply ACLs/xattrs against the held descriptor, so a local user who races the entry or a parent into a symlink cannot redirect an attacker-chosen ACL onto an inode outside the destination tree; a pin that fails where confinement was expected refuses the operation instead of writing by path NOTE: --keep-dirlinks into a destination whose path crosses a directory symlink is now refused (exit 23) rather than applying metadata through it