RHSA-2026:96215: Moderate: patch security update

Q: What attacker-controlled input is needed to exploit this issue?

An attacker would need to supply a crafted diff file. The vulnerability involves filename validation during patch's reversal fallback behavior.

Q: What could exploitation allow?

The issue can allow creation of files outside the working directory when patch processes a crafted diff.

Q: Which Red Hat packages are covered by this update?

The advisory lists redhat/patch, redhat/patch-debuginfo, and redhat/patch-debugsource.

Published Nov 9, 2026

Updated

The patch program applies diff files to originals. The diff command is used to compare an original to a changed file. Diff lists the changes made to the file. A person who has the original file can then use the patch command with the diff file to add the changes to their original file (patching the file).Security Fix(es): patch: Filename validation bypass in reversal fallback allows file creation outside the working directory (CVE-2026-115207) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Affected Software

12 affected componentsFixes available

redhat/patch<2.7.6-12.el8_10

2.7.6-12.el8_10

redhat/patch<2.7.6-12.el8_10

2.7.6-12.el8_10

redhat/patch-debuginfo<2.7.6-12.el8_10

2.7.6-12.el8_10

redhat/patch-debugsource<2.7.6-12.el8_10

2.7.6-12.el8_10

redhat/patch-debuginfo<2.7.6-12.el8_10

2.7.6-12.el8_10

redhat/patch-debugsource<2.7.6-12.el8_10

2.7.6-12.el8_10

redhat/patch<2.7.6-12.el8_10

2.7.6-12.el8_10

redhat/patch-debuginfo<2.7.6-12.el8_10

2.7.6-12.el8_10

redhat/patch-debugsource<2.7.6-12.el8_10

2.7.6-12.el8_10

redhat/patch<2.7.6-12.el8_10.aa

2.7.6-12.el8_10.aa

redhat/patch-debuginfo<2.7.6-12.el8_10.aa

2.7.6-12.el8_10.aa

redhat/patch-debugsource<2.7.6-12.el8_10.aa

2.7.6-12.el8_10.aa

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade redhat/patch to a version that resolves this vulnerability.
Fixed in 2.7.6-12.el8_10
Upgrade
Upgrade redhat/patch-debuginfo to a version that resolves this vulnerability.
Fixed in 2.7.6-12.el8_10
Upgrade
Upgrade redhat/patch-debugsource to a version that resolves this vulnerability.
Fixed in 2.7.6-12.el8_10
Upgrade
Upgrade redhat/patch to a version that resolves this vulnerability.
Fixed in 2.7.6-12.el8_10.aa
Upgrade
Upgrade redhat/patch-debuginfo to a version that resolves this vulnerability.
Fixed in 2.7.6-12.el8_10.aa
Upgrade
Upgrade redhat/patch-debugsource to a version that resolves this vulnerability.
Fixed in 2.7.6-12.el8_10.aa

Event History

Nov 9, 2026

Advisory Published

via Red Hat·12:00 AM

Data Sourced

via Red Hat·12:00 AM

RemedyDescriptionAffected Software

Frequently Asked Questions

What attacker-controlled input is needed to exploit this issue?

An attacker would need to supply a crafted diff file. The vulnerability involves filename validation during patch's reversal fallback behavior.

What could exploitation allow?

The issue can allow creation of files outside the working directory when patch processes a crafted diff.

Which Red Hat packages are covered by this update?

The advisory lists redhat/patch, redhat/patch-debuginfo, and redhat/patch-debugsource.

RHSA-2026:96215: Moderate: patch security update

Affected Software

Remediation

Event History

Frequently Asked Questions

What attacker-controlled input is needed to exploit this issue?

What could exploitation allow?

Which Red Hat packages are covered by this update?

Company

Resources

Contact

Frequently Asked Questions

What attacker-controlled input is needed to exploit this issue?

What could exploitation allow?

Which Red Hat packages are covered by this update?