Back Linuxsecurity

Fedora 43 Nix 2.31.4 Serious Privilege Escalation Flaw GHSA-g3g9-5vj6

Linuxsecurity •LinuxSecurity Advisories • April 17, 2026

Nix is a purely functional package manager. It allows multiple versions of a package to be installed side-by-side, ensures that dependency specifications are complete, supports atomic upgrades and rollbacks, allows non-root users to install software, and has many other features. It is the basis of the NixOS Linux distribution, but it can be used equally well under other Unix systems. See the README.fedora.md file for setup instructions. Update Information : update to 2.31.4 fixes nix-daemon critical GHSA-g3g9-5vj6-r3gj (CVE-2026-39860):

Nix is a purely functional package manager.

It allows multiple versions of a package to be installed side-by-side,

ensures that dependency specifications are complete,

supports atomic upgrades and rollbacks,

allows non-root users to install software, and has many other features.

It is the basis of the NixOS Linux distribution,

but it can be used equally well under other Unix systems.

See the README.fedora.md file for setup instructions.

update to 2.31.4 fixes nix-daemon critical GHSA-g3g9-5vj6-r3gj (CVE-2026-39860):

* Wed Apr 8 2026 Jens Petersen - 2.31.4-1 - update to 2.31.4 - fixes nix-daemon critical GHSA-g3g9-5vj6-r3gj (CVE-2026-39860) * Wed Apr 8 2026 Jens Petersen - 2.31.3-2 - sync readme/gating/tests improvements from rawhide/f44 - document nixGL - enable gating on tier0 and install CI tests

[ 1 ] Bug #2456893 - CVE-2026-39860 nix: privilege escalation via symlink following during output registration [fedora-all]

This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-6c1a1c78c1' at the command line. For more information, refer to the dnf documentation available at

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Privilege Escalation Flaw in Nix Package Manager Fixed in Fedora 43 A serious privilege escalation vulnerability (CVE-2026-39860) was discovered in the Nix package manager, affecting users of Fedora 43 and earlier versions. The flaw allows non-root users to escalate their privileges via symlink following during output registration. This vulnerability was published on April 8, 2026, and has been addressed in the latest update to Nix version 2.31.4. Users are advised to upgrade their systems using the 'dnf' update program to mitigate the risk. The update includes improvements and fixes related to the nix-daemon. The vulnerability poses a significant risk as it can potentially allow unauthorized access to critical system functions. Affected systems include Fedora 42 and 43, as well as other Unix-like systems that utilize Nix. The urgency of the update is underscored by the critical nature of the flaw. 2 sources 73

Extracted Entities

Fedora 43 Nix 2.31.4 Serious Privilege Escalation Flaw GHSA-g3g9-5vj6

The full story

Extracted Entities

CVEs (1)

CWE Weaknesses (1)

Domains (1)

MITRE ATT&CK (1)