Critical Security Update for NetworkManager: Addressing File Access Vulnerability (CVE-2025-9615)
Summary
ALSA-2026:18597: Low: NetworkManager security update. Affects NetworkManager versions < 1:1.54.3-2.el9. Fixed in 1:1.54.3-2.el9. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
NetworkManager is a vital system network service in AlmaLinux that manages network devices and connections, ensuring active network connectivity. It supports various technologies including Ethernet, wireless, mobile broadband (WWAN), and PPPoE, while also integrating with multiple VPN services. This flexibility makes it a crucial component for maintaining network stability and performance in diverse environments.
Vulnerability Detail
The vulnerability identified as CVE-2025-9615 pertains to improper file access within NetworkManager. This flaw could potentially allow unauthorized access to sensitive files, leading to data breaches or system compromise. The issue arises from insufficient validation of file access requests, which could be exploited by attackers to gain elevated privileges or manipulate network configurations.
How To Fix
Minimum fixed version
1:1.54.3-2.el9
This is the first release that contains the fix.
sudo dnf update NetworkManagerTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can restrict access to sensitive files managed by NetworkManager until the update is applied. This can be done by modifying file permissions or using access control lists (ACLs) to limit access to authorized users only.
Conclusion
The CVE-2025-9615 vulnerability in NetworkManager poses significant risks due to improper file access. It is crucial for users to update their systems to the fixed version to mitigate these risks. Temporary workarounds can be employed until the update is applied, and users are encouraged to utilize tools like Vulert for ongoing monitoring.
See every vulnerability recorded for NetworkManager →
FAQ
CVE-2025-9615 is a vulnerability in NetworkManager that allows unauthorized file access, potentially leading to data breaches.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities. Visit Vulert Scanner to check if your application is affected.
If immediate updates are not possible, consider restricting file access as a temporary workaround until the patch can be applied.
Exploitation of this vulnerability could lead to unauthorized access to sensitive files, data breaches, and manipulation of network configurations.
Detailed information about the security update and changes can be found in the AlmaLinux Release Notes linked in the advisory.
Related vulnerabilities
Recent vulnerabilities recorded for NetworkManager.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
