Bug 2533634 (CVE-2026-91837)

Summary: CVE-2026-91837 NetworkManager-iodine: NetworkManager-iodine: local privilege escalation to root via nameserver option injection
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedKeywords: Security
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in NetworkManager-iodine, the iodine VPN plugin for NetworkManager. A local unprivileged user can exploit a vulnerability in how the 'nameserver' setting is processed when establishing an iodine VPN connection. By embedding shell metacharacters (special characters that can execute commands) in the 'nameserver' value, an attacker can inject and execute arbitrary commands. These commands run with root privileges before the application drops its elevated permissions, leading to local privilege escalation.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2533685    
Bug Blocks:    

Description OSIDB Bzimport 2026-09-15 09:29:08 UTC 
A privilege escalation flaw was found in NetworkManager-iodine, the iodine VPN plugin for NetworkManager. When establishing an iodine VPN connection, nm-iodine-service passes the user-controlled "nameserver" setting from the connection profile to the iodine client binary on the command line without an option terminator. A nameserver value prefixed with "-d" can be reinterpreted by iodine's argument parser as the TUN device name option. Iodine truncates this device name to 15 bytes when calling the kernel's TUNSETIFF ioctl, but keeps the full (up to 250-byte) string in a global buffer that is later interpolated, unsanitized, into an ifconfig command executed via system(). Because this command runs before iodine drops privileges via chroot(), setgid(), and setuid(), a local unprivileged user can embed shell metacharacters in the nameserver value of a VPN connection profile to execute arbitrary commands as root.