Information disclosure in Visual Studio and .NET for Linux - CVE-2026-69806

Vulnerability identifier: #VU147965

CSH Severity: Low

CVSS v4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-69806

CWE-ID: CWE-200

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to elevate privileges.

The vulnerability exists due to exposure of sensitive information to an unauthorized actor in .NET for Linux when local users can access process information through the proc filesystem. A local user can access exposed process information to elevate privileges.

Successful exploitation requires a Linux environment in which users share a process identifier namespace. The attacker can gain the privileges of the user account or service account running the affected process.

Visual Studio
.NET for Linux
Red Hat CodeReady Linux Builder for IBM z Systems
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Red Hat CodeReady Linux Builder for x86_64
Red Hat CodeReady Linux Builder for Power, little endian
Red Hat CodeReady Linux Builder for ARM 64
Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support
Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support
Red Hat CodeReady Linux Builder for IBM z Systems - Extended Update Support
Ubuntu
Fedora
dotnet9.0 (Red Hat package)
dotnet9.0
dotnet10.0 (Red Hat package)
dotnet10.0
dotnet10 (Ubuntu package)

Install security update from vendor's website.

Visual Studio - update to 17.14.40
.NET for Linux - update to 9.0.317
dotnet9.0 (Red Hat package) - addressed in versions 9.0.121-1.el8_10, 9.0.121-1.el9_8, 9.0.122-1.el10_0
dotnet9.0 - addressed in versions 9.0.121-1.fc43, 9.0.121-1.fc44
dotnet10.0 (Red Hat package) - addressed in versions 10.0.112-1.el8_10, 10.0.112-1.el9_8, 10.0.112-1.el10_2
dotnet10.0 - addressed in versions 10.0.112-1.fc43, 10.0.112-1.fc44, 10.0.112-1.fc45
dotnet10 (Ubuntu package) - addressed in versions 8.0.31-0ubuntu1~22.04.1, 8.0.31-0ubuntu1~24.04.1, 8.0.131-0ubuntu1~22.04.1, 8.0.131-0ubuntu1~24.04.1, 8.0.131-8.0.31-0ubuntu1~22.04.1, 8.0.131-8.0.31-0ubuntu1~24.04.1, 10.0.12-0ubuntu1~24.04.1, 10.0.12-0ubuntu1~26.04.1, 10.0.112-0ubuntu1~24.04.1, 10.0.112-0ubuntu1~26.04.1, 10.0.112-10.0.12-0ubuntu1~24.04.1, 10.0.112-10.0.12-0ubuntu1~26.04.1

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-69806

• Multiple vulnerabilities in Visual Studio
• Fedora 45 update for dotnet10.0
• Fedora 44 update for dotnet9.0
• Fedora 43 update for dotnet10.0
• Fedora 44 update for dotnet10.0
• Fedora 43 update for dotnet9.0
• Red Hat Enterprise Linux 10 update for .NET 10.0
• Red Hat Enterprise Linux 9 update for .NET 10.0
• Red Hat Enterprise Linux 9 update for .NET 9.0
• Red Hat Enterprise Linux 8 update for .NET 9.0
• Red Hat Enterprise Linux 8 update for .NET 10.0
• Ubuntu update for dotnet10
• Red Hat Enterprise Linux 10 update for .NET 9.0