CVE-2025-9615

Published: Jan 26, 2026Modified: Jun 30, 2026Deferred

3.3

Vector

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Exploitability: 1.8 / Impact: 1.4

Source: secalert@redhat.com (Secondary)

Description

A flaw was found in NetworkManager. The NetworkManager package allows access to files that may belong to other users. NetworkManager allows non-root users to configure the system's network. The daemon runs with root privileges and can access files owned by users different from the one who added the connection.

Related CWEs

Improper Preservation of Permissions

The product does not preserve permissions or incorrectly preserves permissions when copying, restoring, or sharing objects, which can cause them to have less restrictive permissions than intended.

References (7)

https://access.redhat.com/errata/RHSA-2026:18142

Source: secalert@redhat.com

https://access.redhat.com/errata/RHSA-2026:18597

Source: secalert@redhat.com

https://access.redhat.com/security/cve/CVE-2025-9615

Source: secalert@redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=2391503

Source: secalert@redhat.com

https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/issues/1809

Source: secalert@redhat.com

https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/merge_requests/2324

Source: secalert@redhat.com

https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/merge_requests/2327

Source: secalert@redhat.com

Timeline

No history available yet.