CVE-2026-40556: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-40556 is a low-severity directory permission vulnerability in GNU nano that causes the ~/.local directory to be created with overly permissive mode 0777 (world-writable) when it does not yet exist. This occurs on first use of features requiring Cross-Desktop Group (XDG) data storage, and is particularly dangerous in environments with a relaxed or zero umask, such as container environments, CI/CD runners, embedded systems, or shells configured with umask 000. The CVE was published on April 28, 2026, and has subsequently been marked as Rejected by its CVE Numbering Authority. It carries a CVSS v4 base score of 2.1 (Low) (GitHub Advisory, Feedly).

Note: This CVE has been officially rejected/withdrawn by its CVE Numbering Authority. The information below reflects what was reported prior to rejection.

The root cause is classified as CWE-732 (Incorrect Permission Assignment for Critical Resource). GNU nano explicitly requests directory mode 0777 when creating ~/.local for XDG data storage, rather than applying a more restrictive mode. In environments where the process umask does not compensate (e.g., umask 000), the resulting directory is world-writable. A local attacker can exploit a race condition window between nano's creation of ~/.local and its subsequent creation of more restrictive subdirectories within it, allowing the attacker to write attacker-controlled files into the victim's XDG directory hierarchy (GitHub Advisory, CERT.pl).

Successful exploitation allows a local attacker to write arbitrary files into the victim's XDG directory hierarchy (~/.local and subdirectories), potentially leading to unauthorized file placement, privilege escalation, or other forms of local privilege abuse depending on how the compromised files are subsequently used by the system or other applications. The vulnerability has no direct confidentiality or availability impact; the primary risk is integrity compromise of user-level configuration and data files. The impact is most significant in multi-user environments with permissive umask settings, such as shared container environments or CI/CD runners (GitHub Advisory, Feedly).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of reporting. The CVE has been rejected by its CVE Numbering Authority, which may further limit its practical relevance. No threat actor attribution, CISA KEV catalog listing, or EPSS score data is available for this CVE (GitHub Advisory, Feedly).

1. Identify a vulnerable target: Locate a system running GNU nano prior to version 9.0 in an environment with a permissive umask (e.g., umask 000), such as a shared container, CI/CD runner, or embedded system where multiple local users are present.
2. Wait for or trigger nano's first XDG use: Monitor or induce the victim user to run GNU nano in a way that triggers first-time use of XDG data storage features, causing nano to create ~/.local with mode 0777.
3. Exploit the race condition: During the brief window between nano's creation of ~/.local (world-writable) and its creation of more restrictive subdirectories, write attacker-controlled files or symlinks into the victim's ~/.local directory hierarchy.
4. Achieve privilege abuse: Depending on the target environment, the planted files may be loaded by the victim's applications or system services, potentially enabling privilege escalation or persistent unauthorized access (GitHub Advisory, CERT.pl).

• File System: Presence of ~/.local directory owned by a victim user but with permissions drwxrwxrwx (mode 0777); unexpected files or symlinks in ~/.local or its subdirectories not created by the legitimate user.
• Logs: Audit log entries (e.g., auditd) showing file creation events in ~/.local by a user other than the directory owner.
• Process: Unexpected processes writing to another user's ~/.local directory, detectable via tools like inotifywait or auditd file access monitoring.

The vulnerability was fixed in GNU nano version 9.0; users should upgrade to this version or later (GitHub Advisory). The fix is available via the nano git repository (commit cb43493e) (nano git). For systems unable to patch immediately, set a stricter umask (e.g., umask 077) to prevent world-writable directory creation. Additionally, enforce proper filesystem permissions at the system level and monitor XDG directories for unauthorized file creation, particularly in container and CI/CD environments. Note that this CVE has been officially rejected, so risk assessment should account for its withdrawn status.

CERT.pl published a post covering CVE-2026-40556 shortly after its disclosure (CERT.pl). The vulnerability received coverage on Malware News and several CVE tracking platforms. Community reaction was limited given the low severity score and the subsequent rejection of the CVE by its numbering authority.