CVE-2026-25701
NoneCVSS
—
EPSS
0.2%
Published
Feb 25, 2026
CISA due date
—
The record
An Insecure Temporary File vulnerability in openSUSE sdbootutil allows local users to pre-create a directory to achieve various effects like: * gain access to possible private information found in /var/lib/pcrlock.d * manipulate the data backed up in /tmp/pcrlock.d.bak, therefore violating the integrity of the data should it be restored. * overwrite protected system files with data from /var/lib/pcrlock.d by placing symlinks to existing files in the directory tree in /tmp/pcrlock.d.bak. This issue affects sdbootutil: from ? before 5880246d3a02642dc68f5c8cb474bf63cdb56bca.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Tumbleweed | sdbootutil | 0 | 1+git20260303.90d816d-1.1 |
Related vulnerabilities
- CVE-2026-55480 OpenPrinting CUPS is an open source printing system for Linux and other Unix-like… CWE-377
- CVE-2026-106451 yawkat LZ4 Java provides LZ4 compression for Java. CWE-377
- CVE-2026-47852 A local attacker on a multi-user host can pre-create the deterministic cache path and… CWE-377
- CVE-2026-63404 Faktory is a language-agnostic background job server. CWE-377
- CVE-2026-55086 Etherpad is a real-time collaborative editor. CWE-377
- CVE-2026-75920 phpMyFAQ before v4.1.6 writes content backup ZIP archives to the web-accessible document… CWE-377
- CVE-2026-53759 linuxfabrik-lib provides Python modules for database access, caching, shell execution… CWE-377
- CVE-2026-73584 A flaw was found in sblim-sfcb. CWE-377