CVE-2025-9615: 
strongSwan vulnerability analysis and mitigation

CVE-2025-9615 is an information disclosure vulnerability in NetworkManager caused by improper preservation of file access permissions (CWE-281). The NetworkManager daemon runs with root privileges and allows non-root users to configure network connections; however, it does not adequately restrict access to files owned by users other than the one who created the connection, enabling one local user to read files belonging to another. The flaw was reported on August 28, 2025, and published to the NVD on January 26, 2026. Affected software includes NetworkManager as shipped with Red Hat Enterprise Linux 9 and 10, as well as Fedora and openSUSE distributions. It carries a CVSS v3.0 base score of 3.3 (Low) (Red Hat CVE, Red Hat Bugzilla).

The root cause is classified as CWE-281 (Improper Preservation of Permissions). Because the NetworkManager daemon runs as root, it can open and process files specified in network connection profiles without verifying that the requesting user has permission to access those files. A low-privileged local user can craft or reference a connection profile that points to a file owned by another user, and the daemon will read it on their behalf, effectively bypassing filesystem access controls. The attack vector is local, requires low privileges, no user interaction, and has no impact on integrity or availability — only a limited confidentiality impact (Red Hat Bugzilla, NM GitLab Issue).

Successful exploitation allows a low-privileged local user to read the contents of files owned by other users on the same system, including potentially sensitive configuration files, credentials, or private keys referenced in network connection profiles. The impact is limited to confidentiality on the local system; there is no integrity or availability impact, and the vulnerability does not enable privilege escalation or remote access on its own. The risk is most significant on multi-user Linux systems where multiple accounts share the same host (Red Hat CVE, Red Hat Bugzilla).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2025-9615. The EPSS score is extremely low at approximately 0.005%, reflecting a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access and low privileges, limiting the practical attacker pool to users already authenticated on the target system (Red Hat Bugzilla).

Red Hat has released patched packages addressing this vulnerability. For Red Hat Enterprise Linux 10, the fix is included in NetworkManager-1.56.0-1.el10 via security advisory RHSA-2026:18142 (issued May 19, 2026). For Red Hat Enterprise Linux 9, the fix is in NetworkManager-1.54.3-2.el9 via RHSA-2026:18597 (also issued May 19, 2026). Fedora and openSUSE have also released updated NetworkManager packages. Administrators should apply the relevant vendor update as the primary remediation; no configuration-based workaround has been published (RHSA-2026:18142, RHSA-2026:18597).

Coverage of CVE-2025-9615 has been limited to routine Linux security advisory aggregators such as LinuxSecurity.com, LinuxCompatible.org, and pro-linux.de, which republished vendor advisories for Fedora, openSUSE, and SUSE. No notable independent researcher commentary, social media discussion, or mainstream media coverage has been identified, consistent with the vulnerability's low severity rating.