RHSA-2026:98105: Important: libimobiledevice security update
libimobiledevice is a library for connecting to mobile devices including phones and music playersSecurity Fix(es): libimobiledevice: libimobiledevice: Denial of Service via double free in servicereceive (CVE-2026-116260) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/libimobiledeviceto a version that resolves this vulnerability.Fixed in 1.2.0-18.el8_10 - Upgrade
Upgrade
redhat/libimobiledevice-debuginfoto a version that resolves this vulnerability.Fixed in 1.2.0-18.el8_10 - Upgrade
Upgrade
redhat/libimobiledevice-debugsourceto a version that resolves this vulnerability.Fixed in 1.2.0-18.el8_10 - Upgrade
Upgrade
redhat/libimobiledevice-utils-debuginfoto a version that resolves this vulnerability.Fixed in 1.2.0-18.el8_10 - Upgrade
Upgrade
redhat/libimobiledeviceto a version that resolves this vulnerability.Fixed in 1.2.0-18.el8_10.aa - Upgrade
Upgrade
redhat/libimobiledevice-debuginfoto a version that resolves this vulnerability.Fixed in 1.2.0-18.el8_10.aa - Upgrade
Upgrade
redhat/libimobiledevice-debugsourceto a version that resolves this vulnerability.Fixed in 1.2.0-18.el8_10.aa - Upgrade
Upgrade
redhat/libimobiledevice-utils-debuginfoto a version that resolves this vulnerability.Fixed in 1.2.0-18.el8_10.aa - Upgrade
Upgrade
redhat/libimobiledevice-develto a version that resolves this vulnerability.Fixed in 1.2.0-18.el8_10 - Upgrade
Upgrade
redhat/libimobiledevice-develto a version that resolves this vulnerability.Fixed in 1.2.0-18.el8_10.aa
Event History
Frequently Asked Questions
What systems are affected by this update?
Systems with the Red Hat libimobiledevice packages installed are in scope, including libimobiledevice, libimobiledevice-devel, and the listed debug and debuginfo packages.
What is the impact of the vulnerability?
The issue is a double free in service_receive that can cause a denial of service.
How should affected systems be remediated?
Apply RHSA-2026:98105 to update the affected libimobiledevice packages.