CVE-2026-96231

Overview

.NET is a free, open-source, cross-platform framework for building modern apps and powerful cloud services. It consists of a runtime and a developer platform made up of tools, programming languages, and libraries for building many different types of applications.

An elevation of privilege vulnerability (CVE-2026-96231) has been identified in .NET's named mutex support on Linux and macOS, which allows a local attacker to make a more privileged .NET process truncate and overwrite a file the attacker cannot otherwise write. Windows is not affected.

Per CWE-59: Improper Link Resolution Before File Access ('Link Following'), the weakness is a product that accesses a file based on its filename but does not properly prevent that name from resolving to a link that points outside the intended control sphere.

This issue affects .NET 6 applications on Linux and macOS that use named System.Threading.Mutex objects, including the End-of-Life .NET 6.0 line covered by NES, on machines where another local user can run code. Microsoft's advisory lists the .NET runtime packs for 8.0, 9.0, 10.0 and the 11.0 previews as affected; .NET 6 is past end of life and is not assessed there, and HeroDevs confirmed that 6.0 carries the same code path.

Additionally, if you've deployed self-contained applications targeting any of the impacted versions, these applications are also vulnerable and must be recompiled and redeployed.

Details

Module Info

• Product: .NET
• Affected packages: Microsoft.NETCore.App (the .NET shared framework and runtime packs; the named mutex code is in-box in libcoreclr and System.Private.CoreLib, not an opt-in package)
• Affected versions:
  
  • >= 6.0.0 <= 6.0.46 (Linux and macOS)
• Package manager: NuGet, Linux packages (.deb, .rpm), Docker
• GitHub repository: https://github.com/dotnet/runtime
• Published packages: Download .NET (Linux, macOS, and Windows)
• Fixed in:
  
  • NES for .NET 6.0.47

Vulnerability Info

This High-severity vulnerability is found in the Unix platform layer of the Microsoft.NETCore.App shared framework. On Linux and macOS, named mutexes are backed by shared memory and lock files under the system temporary directory (/tmp/.dotnet by default), in directories the runtime created writable by every user and without the sticky bit. The runtime opened the shared memory and lock files inside them by path, following symbolic links, and then resized them. A local user who placed a link where one of those files was expected could cause a privileged process that opens a named mutex to truncate the link's target and overwrite it with mutex data.

NES for .NET 6.0.47 applies the same change Microsoft made in .NET 8 servicing. Named mutexes are now private to the current user by default, kept in a per-user location with owner-only permissions. Every runtime-owned directory and file is opened relative to its parent without following links, and the permissions of an existing directory are never changed.

Compatibility note: two processes running as different users no longer share a named mutex by default. Setting the AppContext switch System.Threading.Mutex.UnsafeDefaultMutexScopeGlobal to true in both processes restores the previous all-users location, which still carries the link-following protections. Processes running as the same user are unaffected.

CVE-2026-96225 and CVE-2026-96231 were reported separately and are addressed together by the same named mutex hardening in NES for .NET 6.0.47.

This vulnerability has been present since at least .NET 6.0 and likely earlier.

Mitigation

.NET 6 is End-of-Life and will not receive any updates to address this issue. For more information see .NET and .NET Core official support policy.

Users of the affected components should apply one of the following mitigations:

• Upgrade affected applications to one of:
  
  • NES for .NET 6.0.47 or later
  • .NET 8.0.32 or later
  • .NET 9.0.21 or later
  • .NET 10.0.13 or later
• Leverage a commercial support partner like HeroDevs for post-EOL security support, including NES for .NET 6.0.47 or later. Review the compatibility note above if processes running as different users share a named mutex.

Credits

Nguyễn Văn Minh Đức with Saigon Newport Corporation, as credited in Microsoft's advisory.