Description
A flaw was found in GNU patch. An attacker can achieve arbitrary file creation outside the intended working directory by enticing a user or automated workflow to apply a specially crafted patch file. Due to missing validation during automatic patch reversal, absolute file paths in patch headers are accepted rather than rejected. Consequently, the utility can create files in arbitrary locations with the permissions of the executing user.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 8 | — | — |
| Red Hat | Red Hat Enterprise Linux 9.8 Extended Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 10 | — | — |
| Red Hat | Red Hat Enterprise Linux 6 | — | — |
| Red Hat | Red Hat Enterprise Linux 7 | — | — |
| Red Hat | Red Hat Enterprise Linux 9 | — | — |
| Red Hat | Red Hat Hardened Images | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | patch | 2.8.1-1 | — |
| Debian 13 | patch | No fix yet | — |
| Debian 12 | patch | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | patch | No fix yet | — |
| Ubuntu 26.04 LTS | patch | No fix yet | — |
| Ubuntu 24.04 LTS | patch | No fix yet | — |
| Ubuntu 22.04 LTS | patch | No fix yet | — |
| Ubuntu 20.04 LTS | patch | No fix yet | — |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | patch | No fix yet | — |
| Ubuntu 16.04 LTS | patch | No fix yet | — |
| Ubuntu Pro 14.04 LTS | patch | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 8 | patch | 2.7.6-12.el8_10 | RHSA-2026:96215 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9.8 EUS | patch | 2.7.6-16.el9_8.1 | RHSA-2026:99161 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 8 | patch | 2.7.6-12.el8_10 | ALSA-2026:96215 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 8 | patch | 2.7.6-12.el8_10 | RLSA-2026:96215 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | patch | 2.8.1-1.1 | openSUSE-SU-2026:12302-1 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | patch | No fix yet | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 8 | patch | 2.7.6-12.el8_10 | ELSA-2026-96215 |
Advisories 7
- RHSA-2026:99161 Red Hat Security Advisory: patch security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:96215 Red Hat Security Advisory: patch security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- WID-SEC-2026-4173 GNU patch: Schwachstelle ermöglicht Manipulation von Dateien BSI CERT-Bund (WID) · Nov 11, 2026
- RLSA-2026:96215 Moderate: patch security update Rocky Linux Security Advisories · Nov 10, 2026
- ALSA-2026:96215 Moderate: patch security update AlmaLinux Security Advisories · Nov 10, 2026
- ELSA-2026-96215 Moderate: patch security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Nov 9, 2026
- openSUSE-SU-2026:12302-1 patch-2.8.1-1.1 on GA media SUSE / openSUSE Security Updates · Oct 28, 2026
References
- RHSA-2026:96215 vendor-advisory
- RHSA-2026:99161 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2026-115207 vdb-entry
- RHBZ#2558775 issue-tracking