CVE-2026-25701

Name of the Vulnerable Software and Affected Versions openSUSE sdbootutil versions prior to 5880246d3a02642dc68f5c8cb474bf63cdb56bca

Description An insecure temporary file issue exists in openSUSE sdbootutil. A local user can pre-create a directory, potentially gaining access to private information located in /var/lib/pcrlock.d, manipulating data backed up in /tmp/pcrlock.d.bak, and overwriting protected system files with data from /var/lib/pcrlock.d by placing symlinks in /tmp/pcrlock.d.bak. This can violate data integrity if the backed-up data is restored.

Recommendations Update openSUSE sdbootutil to a version after 5880246d3a02642dc68f5c8cb474bf63cdb56bca.