Description
A flaw was found in the user's crate for Rust. This vulnerability allows privilege escalation via incorrect group listing when a user or process has fewer than exactly 1024 groups, leading to the erroneous inclusion of the root group in the access list.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | rust-users | 0.8.0 – < 0.11.1 | 0.11.1 |
| Red Hat | Red Hat OpenShift sandboxed containers 1.10 | — | — |
| Red Hat | Red Hat Enterprise Linux 10 | — | — |
| Red Hat | Red Hat Enterprise Linux 9 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4 | — | — |
| Red Hat | Red Hat Trusted Profile Analyzer | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 24.04 LTS | rust-users | No fix yet | — |
| Ubuntu 22.04 LTS | rust-users | No fix yet | — |
| Ubuntu 20.04 LTS | rust-users | No fix yet | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | himmelblau | 0.7.17+git.0.1ebdab0-150700.3.3.2 | SUSE-SU-2025:02166-1 |
Show 6 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLE Micro 6.1 | afterburn | 5.9.0.git21.a73f509-slfo.1.1_1.1 | SUSE-SU-2026:23071-1, SUSE-RU-2025:20961-1 |
| SLE Micro 6.0 | afterburn | 5.9.0.git21.a73f509-1.1 | SUSE-SU-2026:22917-1, SUSE-RU-2025:21046-1 |
| SLE Micro 5.5 | afterburn | 5.9.0.git21.a73f509-150500.3.3.1 | SUSE-SU-2025:3784-1 |
| SLE Micro 5.4 | afterburn | 5.9.0.git21.a73f509-150400.3.3.1 | SUSE-SU-2025:3785-1 |
| SLE Micro 5.3 | afterburn | 5.9.0.git21.a73f509-150400.3.3.1 | SUSE-SU-2025:3786-1 |
| SLE Micro 5.2 | afterburn | 5.9.0.git21.a73f509-150300.3.5.1 | SUSE-SU-2025:3783-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | afterburn | 5.8.2-3.1 | openSUSE-SU-2025:15335-1 |
| openSUSE Tumbleweed | agama | 17+60.68fdb92ec-26.1 | openSUSE-SU-2025:15412-1 |
| openSUSE Tumbleweed | flake-pilot | 3.1.19-1.1 | openSUSE-SU-2025:15217-1 |
| openSUSE Tumbleweed | lsd | 1.2.0-1.1 | openSUSE-SU-2025:15628-1 |
| openSUSE Tumbleweed | mirrorsorcerer | 0.1.3~1-1.1 | openSUSE-SU-2025:15246-1 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | kata-containers-cc | 3.15.0.aks0-15 | — |
| Azure Linux 2 (CBL-Mariner) | kata-containers-cc | 3.2.0.azl2-7 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| crates.io | users | >= 0.8.0, <= 0.11.0 | — | GHSA-m65q-v92h-cm7q |
| crates.io | users | >= 0.8.0 | — | RUSTSEC-2025-0040 |
Advisories 14
- SUSE-SU-2026:23071-1 Security update for afterburn SUSE / openSUSE Security Updates · Aug 14, 2026
- SUSE-SU-2026:22917-1 Security update for afterburn SUSE / openSUSE Security Updates · Jul 28, 2026
- openSUSE-SU-2025:15628-1 lsd-1.2.0-1.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
- openSUSE-SU-2025:15412-1 agama-17+60.68fdb92ec-26.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
- openSUSE-SU-2025:15246-1 mirrorsorcerer-0.1.3~1-1.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
- openSUSE-SU-2025:15217-1 flake-pilot-3.1.19-1.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-RU-2025:20961-1 Recommended update for afterburn SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-RU-2025:21046-1 Recommended update for afterburn SUSE / openSUSE Security Updates · Mar 23, 2026
- openSUSE-SU-2025:15335-1 afterburn-5.8.2-3.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2025:3784-1 Security update for afterburn SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2025:3783-1 Security update for afterburn SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2025:3785-1 Security update for afterburn SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2025:3786-1 Security update for afterburn SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2025:02166-1 Security update for himmelblau SUSE / openSUSE Security Updates · Feb 4, 2026