RLSA-2026:96215: Moderate: patch security update

Q: What access or interaction is required to exploit this issue?

The CVSS vector indicates local access, low attack complexity, no privileges required, and user interaction required. An attacker would need a user to process a crafted patch or diff file.

Q: What is the impact of a successful exploit?

Successful exploitation can allow creation of files outside the intended working directory. The CVSS vector rates integrity impact as high, with no confidentiality or availability impact.

Q: How can exposure be reduced if the update cannot be applied immediately?

Avoid applying patch or diff files from untrusted sources, particularly where a crafted file could be supplied to a user for processing. Review patching workflows that handle externally provided diffs.

Published Nov 10, 2026

Updated

The patch program applies diff files to originals. The diff command is used to compare an original to a changed file. Diff lists the changes made to the file. A person who has the original file can then use the patch command with the diff file to add the changes to their original file (patching the file).

Security Fix(es):

patch: Filename validation bypass in reversal fallback allows file creation outside the working directory (CVE-2026-115207)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Affected Software

1 affected componentFixes available

rocky-linux/patch<0:2.7.6-12.el8_10

0:2.7.6-12.el8_10

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade rocky-linux/patch to a version that resolves this vulnerability.
Fixed in 0:2.7.6-12.el8_10

Event History

Nov 10, 2026

Advisory Published

via OSV·12:01 PM

Data Sourced

via OSV·12:01 PM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-115207

Frequently Asked Questions

What access or interaction is required to exploit this issue?

The CVSS vector indicates local access, low attack complexity, no privileges required, and user interaction required. An attacker would need a user to process a crafted patch or diff file.

What is the impact of a successful exploit?

Successful exploitation can allow creation of files outside the intended working directory. The CVSS vector rates integrity impact as high, with no confidentiality or availability impact.

How can exposure be reduced if the update cannot be applied immediately?

Avoid applying patch or diff files from untrusted sources, particularly where a crafted file could be supplied to a user for processing. Review patching workflows that handle externally provided diffs.

RLSA-2026:96215: Moderate: patch security update

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

What access or interaction is required to exploit this issue?

What is the impact of a successful exploit?

How can exposure be reduced if the update cannot be applied immediately?

Company

Resources

Contact

Frequently Asked Questions

What access or interaction is required to exploit this issue?

What is the impact of a successful exploit?

How can exposure be reduced if the update cannot be applied immediately?