fedora-qa / blocker-review

#2105 [nix] CVE-2026-39860 nix: privilege escalation via symlink following during output registration [fedora-all] | rhbz#2456893
Closed by blockerbot. Opened by blockerbot.

Closed
Reopen Issue

Bug details: ** https://bugzilla.redhat.com/show_bug.cgi?id=2456893 **
Information from BlockerBugs App:
2456893

Current vote summary

  • Accepted FinalFreezeException (+0, 0, -0)

Commented but haven't voted yet: lruzicka

The votes have been last counted at 2026-04-13 18:33 UTC and the last processed comment was #comment-1010990

To learn how to vote, see:
https://pagure.io/fedora-qa/blocker-review
A quick example: BetaBlocker +1 (where the tracker name is one of BetaBlocker/FinalBlocker/BetaFE/FinalFE/0Day/PreviousRelease and the vote is one of +1/0/-1)

AGREED AcceptedFinalFreezeException

Discussed at the 2026-04-13 (blocker / freeze exception) review meeting:

This is accepted as it's nice to fix CVEs in the stable repo for folks installing or upgrading ahead of release. It's not a blocker as nix isn't included in any release-blocking images by default.

https://meetbot-raw.fedoraproject.org//blocker-review_matrix_fedoraproject-org/2026-04-13/f44-blocker-review.2026-04-13-16.00.log.txt

The following votes have been closed:

  • Accepted FinalFreezeException (+0, 0, -0)

Metadata Update from @blockerbot:
- Issue status updated to: Closed (was: Open)

Release F44 is no longer tracked by BlockerBugs, closing this ticket.
Metadata
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.