This vulnerability involves incorrect permission assignment for the ~/.local directory in Red Hat Enterprise Linux 10 when using nano, resulting in permissions set to 0777 instead of 0700 under permissive umask settings. This allows a local attacker to place a malicious .desktop launcher file in that directory, potentially causing unintended actions or information disclosure if the launcher is processed. The CVSS 3.1 base score is 2.5, reflecting low severity with local attack vector, high attack complexity, low privileges required, no user interaction, and limited integrity impact. Red Hat has published an advisory but has not indicated an official fix or remediation level at this time.

The impact is limited to local attackers who can exploit overly permissive directory permissions to inject malicious launcher files. This could lead to unintended actions or information disclosure but does not affect system confidentiality or availability. The low CVSS score and absence of known exploits indicate limited risk currently.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-6842 for current remediation guidance. Until an official fix is available, users should consider tightening umask settings to avoid permissive directory permissions and restrict local user access to prevent exploitation.