Description
Avahi before 0.6.15 does not verify the sender identity of netlink messages to ensure that they come from the kernel instead of another process, which allows local users to spoof network changes to Avahi.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | avahi | 0.6.15-1 | — |
| Debian 13 | avahi | 0.6.15-1 | — |
| Debian 12 | avahi | 0.6.15-1 | — |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | avahi | 0.8-7.2 | openSUSE-SU-2024:10643-1 |
Advisories 1
- openSUSE-SU-2024:10643-1 avahi-0.8-7.2 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- 22932 third-party-advisory
- 23042 third-party-advisory
- SUSE-SR:2006:026 vendor-advisory
- 22852 third-party-advisory
- USN-380-1 vendor-advisory
- ADV-2006-4474 vdb-entry
- 23020 third-party-advisory
- 22807 third-party-advisory
- http://avahi.org/milestone/Avahi%200.6.15
- 1017257 vdb-entry
- [avahi-tickets] 20061106 [Avahi] #69: Avahi needs to check the originating process of netlink messages mailing-list
- MDKSA-2006:215 vendor-advisory
- avahi-netlink-security-bypass(30207) vdb-entry
- GLSA-200611-13 vendor-advisory
- 21016 vdb-entry