PatchSiren cyber security CVE debrief

CVE-2025-9615 Red Hat CVE debrief

A local information disclosure vulnerability in NetworkManager allows non-root users to configure network connections in ways that cause the root-privileged daemon to access files belonging to other users. The flaw stems from improper handling of file ownership boundaries when processing user-supplied network configuration. With local access and low privileges, an attacker could potentially read sensitive files owned by other users through crafted network configuration directives. The CVSS 3.3 LOW severity reflects the required local access and limited confidentiality impact. Red Hat has issued security advisories RHSA-2026:18142 and RHSA-2026:18597 addressing this issue. The vulnerability was tracked in GitLab issue #1809 and resolved through merge requests !2324 and !2327.

Vendor: Red Hat
Product: Red Hat Enterprise Linux 10
CVSS: LOW 3.3
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-01-26
Original CVE updated: 2026-05-19
Advisory published: 2026-01-26
Advisory updated: 2026-05-19

Who should care

System administrators managing multi-user Linux environments with NetworkManager enabled; security teams monitoring local privilege escalation vectors; organizations using Red Hat Enterprise Linux or distributions shipping NetworkManager

Technical summary

The NetworkManager daemon runs with root privileges to manage system network configurations. The vulnerability exists because the daemon does not properly validate file ownership boundaries when processing user-supplied connection configurations. A local user with privileges to add network connections can specify paths or configurations that cause the root-privileged daemon to access files owned by other users, resulting in information disclosure. The attack requires local access and valid user credentials, with no user interaction needed. The confidentiality impact is limited (LOW) per CVSS scoring, with no integrity or availability impact.

Defensive priority

low

Recommended defensive actions

Apply Red Hat security advisories RHSA-2026:18142 and RHSA-2026:18597 when available for affected systems
Review NetworkManager configurations for unauthorized connection definitions added by non-privileged users
Monitor for unusual network configuration changes in multi-user environments
Validate that NetworkManager packages are updated to versions containing merge requests !2324 and !2327
Consider restricting NetworkManager configuration privileges to administrative accounts where feasible

Evidence notes

Vulnerability description sourced from NVD record with CVSS vector AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. Vendor attribution to Red Hat supported by multiple errata references and Bugzilla entry. Technical details confirmed through upstream GitLab issue and merge requests. CWE-281 (Improper Preservation of Privileges) classified by Red Hat.

Official resources

2026-01-26