Bug 2456893

Summary:	CVE-2026-39860 nix: privilege escalation via symlink following during output registration [fedora-all]
Product:	[Fedora] Fedora	Reporter:	Guilherme de Almeida Suckevicz <gsuckevi>
Component:	nix	Assignee:	Jens Petersen <petersen>
Status:	CLOSED ERRATA	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	rawhide	CC:	petersen
Target Milestone:	---	Keywords:	Security, SecurityTracking
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:	AcceptedFreezeException {"flaws": ["1e9fafaa-3009-452a-bfb7-cd904f109bcb"]}
Fixed In Version:	nix-2.34.5-1.fc44 nix-2.31.4-1.fc43 nix-2.31.4-1.fc42	Doc Type:	---
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2026-04-16 23:41:03 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	2456813, 2362360

Description Guilherme de Almeida Suckevicz 2026-04-09 13:19:31 UTC

Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

Comment 1 Fedora Update System 2026-04-10 03:58:19 UTC

FEDORA-2026-8c7366e046 (nix-2.34.5-1.fc44) has been submitted as an update to Fedora 44.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-8c7366e046

Comment 2 Fedora Update System 2026-04-10 03:59:17 UTC

FEDORA-2026-6c1a1c78c1 (nix-2.31.4-1.fc43) has been submitted as an update to Fedora 43.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-6c1a1c78c1

Comment 3 Fedora Update System 2026-04-10 03:59:49 UTC

FEDORA-2026-02fa328deb (nix-2.31.4-1.fc42) has been submitted as an update to Fedora 42.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-02fa328deb

Comment 4 Jens Petersen 2026-04-13 12:41:38 UTC

See https://github.com/NixOS/nix/security/advisories/GHSA-g3g9-5vj6-r3gj for more details.

Comment 5 Lukas Ruzicka 2026-04-13 18:32:14 UTC

AGREED AcceptedFinalFreezeException

Discussed at the 2026-04-13 (blocker / freeze exception) review meeting:

This is accepted as it's nice to fix CVEs in the stable repo for folks installing or upgrading ahead of release. It's not a blocker as nix isn't included in any release-blocking images by default.

https://meetbot-raw.fedoraproject.org//blocker-review_matrix_fedoraproject-org/2026-04-13/f44-blocker-review.2026-04-13-16.00.log.txt

Comment 6 Fedora Update System 2026-04-16 23:41:03 UTC

FEDORA-2026-8c7366e046 (nix-2.34.5-1.fc44) has been pushed to the Fedora 44 stable repository.
If problem still persists, please make note of it in this bug report.

Comment 7 Fedora Update System 2026-04-17 00:53:43 UTC

FEDORA-2026-6c1a1c78c1 (nix-2.31.4-1.fc43) has been pushed to the Fedora 43 stable repository.
If problem still persists, please make note of it in this bug report.

Comment 8 Fedora Update System 2026-04-17 01:11:54 UTC

FEDORA-2026-02fa328deb (nix-2.31.4-1.fc42) has been pushed to the Fedora 42 stable repository.
If problem still persists, please make note of it in this bug report.