CVE-2026-25701: openSUSE sdbootutil Privilege Escalation

CVE-2026-25701 Overview

CVE-2026-25701 is an insecure temporary file vulnerability [CWE-377] in openSUSE sdbootutil. Local users can pre-create directories used by the utility to influence its file operations. The flaw allows access to potentially private information stored in /var/lib/pcrlock.d. Attackers can also manipulate backup data in /tmp/pcrlock.d.bak, breaking integrity guarantees during restore operations. By placing symlinks inside a pre-created /tmp/pcrlock.d.bak, a local user can cause sdbootutil to overwrite protected system files with content from /var/lib/pcrlock.d. The issue affects sdbootutil builds prior to commit 5880246d3a02642dc68f5c8cb474bf63cdb56bca.

Critical Impact
Local low-privileged users can overwrite arbitrary protected system files via symlink attacks against /tmp/pcrlock.d.bak, leading to integrity loss and potential privilege escalation.

Affected Products

openSUSE sdbootutil versions prior to commit 5880246d3a02642dc68f5c8cb474bf63cdb56bca
openSUSE distributions packaging the vulnerable sdbootutil builds
Systems using sdbootutil for systemd-boot and pcrlock management

Discovery Timeline

2026-02-25 - CVE-2026-25701 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2026-25701

Vulnerability Analysis

The vulnerability stems from sdbootutil operating on predictable, non-exclusive paths under /tmp and /var/lib. The utility uses /tmp/pcrlock.d.bak as a backup location and /var/lib/pcrlock.d as a source directory without verifying that these paths are not pre-created or controlled by another user. Because /tmp is world-writable, any local user can create the target directory before sdbootutil runs.

Three distinct outcomes are reachable. First, a pre-created directory with permissive permissions grants the attacker read access to files written from /var/lib/pcrlock.d, exposing potentially private TPM-related data. Second, attacker-controlled directory contents in /tmp/pcrlock.d.bak can be tampered with, undermining backup integrity. Third, placing symlinks inside the pre-created backup directory redirects writes performed by the privileged sdbootutil process to arbitrary files on the filesystem.

Root Cause

The root cause is improper handling of temporary files and directories [CWE-377]. sdbootutil does not create its working directories using exclusive, unpredictable, or properly permissioned operations such as mkdtemp(3). It also fails to validate path types and link targets before performing copy and restore actions.

Attack Vector

Exploitation requires local access with low privileges. An attacker pre-creates /tmp/pcrlock.d.bak and populates it with symbolic links pointing to protected files such as configuration or boot integrity data. When an administrator or automated workflow invokes sdbootutil, the utility follows the symlinks and writes data sourced from /var/lib/pcrlock.d over the linked targets. The fix landed in commit 5880246d3a02642dc68f5c8cb474bf63cdb56bca. Technical details are available in the SUSE Bug Report #1258241.

Detection Methods for CVE-2026-25701

Indicators of Compromise

Presence of /tmp/pcrlock.d.bak owned by a non-root user prior to sdbootutil execution.
Symbolic links inside /tmp/pcrlock.d.bak that point outside the directory, particularly to system paths.
Unexpected modifications to protected system files coinciding with sdbootutil invocations.

Detection Strategies

Audit filesystem events on /tmp/pcrlock.d.bak and /var/lib/pcrlock.d using auditd watch rules to capture creation, symlink, and write activity.
Correlate sdbootutil process executions with file write operations targeting paths outside /tmp and /var/lib/pcrlock.d.
Hash and compare critical boot and integrity files before and after sdbootutil runs to detect unauthorized overwrites.

Monitoring Recommendations

Monitor for non-root processes creating directories under /tmp that match names used by privileged utilities.
Alert on readlink or lstat anomalies in privileged scripts that interact with /tmp.
Track package versions of sdbootutil across the fleet to confirm patched builds are deployed.

How to Mitigate CVE-2026-25701

Immediate Actions Required

Update sdbootutil to a build that includes commit 5880246d3a02642dc68f5c8cb474bf63cdb56bca or later.
Restrict local shell access on systems where sdbootutil is invoked by administrators or automation.
Inspect /tmp/pcrlock.d.bak for pre-existing entries before running sdbootutil and remove suspicious content.

Patch Information

The vendor fix is committed upstream as 5880246d3a02642dc68f5c8cb474bf63cdb56bca. Refer to the SUSE Bug Report #1258241 for vendor advisory details and packaging status across openSUSE distributions.

Workarounds

Avoid running sdbootutil on multi-user systems until patched packages are installed.
Configure /tmp with private namespaces via systemdPrivateTmp=yes for services that wrap sdbootutil.
Manually pre-create /tmp/pcrlock.d.bak as root with 0700 permissions immediately before invoking sdbootutil to block unprivileged squatting.

bash

# Pre-create the backup directory as root with restrictive permissions
sudo rm -rf /tmp/pcrlock.d.bak
sudo install -d -m 0700 -o root -g root /tmp/pcrlock.d.bak
sudo sdbootutil <subcommand>