CVE-2026-25701 Details
Description
An Insecure Temporary File vulnerability in openSUSE sdbootutil allows local users to pre-create a directory to achieve various effects like: * gain access to possible private information found in /var/lib/pcrlock.d * manipulate the data backed up in /tmp/pcrlock.d.bak, therefore violating the integrity of the data should it be restored. * overwrite protected system files with data from /var/lib/pcrlock.d by placing symlinks to existing files in the directory tree in /tmp/pcrlock.d.bak. This issue affects sdbootutil: from ? before 5880246d3a02642dc68f5c8cb474bf63cdb56bca.
A vulnerability in openSUSE sdbootutil has been identified, allowing local users to exploit an insecure temporary file issue. This vulnerability arises from the use of a predictable temporary directory in a systemd service, which can be pre-created by users to access private information in '/var/lib/pcrlock.d', manipulate backup data in '/tmp/pcrlock.d.bak', or overwrite protected system files by using symlinks. The issue affects sdbootutil versions prior to a specific commit in the Tumbleweed release.
It is recommended to modify the systemd service to use a secure, unpredictable directory for backups, such as one created with 'mktemp -d', or to check for the existence of the directory and error out if it already exists.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Feb 25, 2026CISA-ADP
Assessed Feb 25, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://bugzilla.suse.com/show_bug.cgi?id=1258241 | [email protected] | Issue TrackingTechnical DescriptionVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-377 | Insecure Temporary File | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| openSUSE sdbootutil | All versions |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Feb 25, 2026 | New CVE Received | [email protected] |