https://seclists.org/oss-sec/2026/q4/391: GNU patch 2.8.1 leased, fixes CVE-2026-115207

Q: What must an attacker control to exploit this issue?

They need to supply a patch that is reverse-applied and deletes a file. The vulnerable behavior occurs when the pathname in that operation is not checked for safety.

Q: Which workflows are exposed?

Workflows that reverse-apply patches which delete files are exposed to the unsafe pathname handling. The supplied information does not identify a default configuration condition.

Q: What should be done if patching cannot happen immediately?

Avoid reverse-applying patches that delete files unless their paths are trusted and reviewed. GNU patch 2.8.1 was released with the missing pathname safety check.

Published Oct 26, 2026

Updated

Affected Software

1 affected component

GNU patch<2.8.1

Frequently Asked Questions

What must an attacker control to exploit this issue?

They need to supply a patch that is reverse-applied and deletes a file. The vulnerable behavior occurs when the pathname in that operation is not checked for safety.

Which workflows are exposed?

Workflows that reverse-apply patches which delete files are exposed to the unsafe pathname handling. The supplied information does not identify a default configuration condition.

What should be done if patching cannot happen immediately?

Avoid reverse-applying patches that delete files unless their paths are trusted and reviewed. GNU patch 2.8.1 was released with the missing pathname safety check.