UBUNTU-CVE-2026-114148: Medium severity ubuntu/dotnet6 vulnerability
Unsafe ownership metadata in affected .NET tarballs could allow a local attacker to modify files and gain elevated privileges.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/dotnet8to a version that resolves this vulnerability.Fixed in 8.0.133-8.0.33-0ubuntu1~22.04.1 - Upgrade
Upgrade
ubuntu/dotnet10to a version that resolves this vulnerability.Fixed in 10.0.114-10.0.14-0ubuntu1~24.04.1 - Upgrade
Upgrade
ubuntu/dotnet8to a version that resolves this vulnerability.Fixed in 8.0.133-8.0.33-0ubuntu1~24.04.1 - Upgrade
Upgrade
ubuntu/dotnet10to a version that resolves this vulnerability.Fixed in 10.0.114-10.0.14-0ubuntu1~26.10.1 - Upgrade
Upgrade
ubuntu/dotnet11to a version that resolves this vulnerability.Fixed in 11.0.100-11.0.0~rc3-0ubuntu1~26.10.1 - Upgrade
Upgrade
ubuntu/dotnet10to a version that resolves this vulnerability.Fixed in 10.0.114-10.0.14-0ubuntu1~26.04.1
Event History
Frequently Asked Questions
Which Ubuntu .NET package lines are identified as affected?
The affected package lines are ubuntu/dotnet6, ubuntu/dotnet8, ubuntu/dotnet10, and ubuntu/dotnet11.
Does exploitation require an attacker to already have local access?
Yes. The issue is described as exploitable by a local attacker, rather than identifying a remote attack path.