CVE-2025-9615 is a security flaw in NetworkManager where the daemon, running with root privileges, permits non-root users to configure the system's network and access files belonging to other users. This improper access control issue is categorized under CWE-281 (Improper Authentication). The vulnerability affects versions of NetworkManager prior to 1.54.3-2ubuntu1 and various Red Hat Enterprise Linux 10 variants. The flaw allows local attackers with limited privileges to gain read access to files owned by other users via NetworkManager's privileged operations.

The vulnerability allows local non-root users to access files owned by other users due to insufficient access control in NetworkManager's privileged daemon. This could lead to unauthorized disclosure of sensitive information. The CVSS score of 3.3 reflects a low to medium impact primarily on confidentiality, with no impact on integrity or availability reported. There are no known exploits in the wild at this time.

An official patch is available from Red Hat and Ubuntu to address this vulnerability. Users should apply the NetworkManager updates provided in Red Hat Enterprise Linux 10 and Ubuntu versions prior to 1.54.3-2ubuntu1 as soon as possible. Refer to the Red Hat advisory RHSA-2026:18142 and Ubuntu security updates for detailed patching instructions. No additional mitigation steps are required beyond applying the official fixes.