Red Hat Product Errata RHSA-2026:0199 - Security Advisory
Issued:
2026-01-07
Updated:
2026-01-07

RHSA-2026:0199 - Security Advisory

Synopsis

Important: git-lfs security update

Type/Severity

Security Advisory: Important

Red Hat Lightspeed patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update for git-lfs is now available for Red Hat Enterprise Linux 9.6 Extended Update Support.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server.

Security Fix(es):

  • git-lfs: Git LFS may write to arbitrary files via crafted symlinks (CVE-2025-26625)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.6 x86_64
  • Red Hat Enterprise Linux Server - AUS 9.6 x86_64
  • Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 9.6 s390x
  • Red Hat Enterprise Linux for Power, little endian - Extended Update Support 9.6 ppc64le
  • Red Hat Enterprise Linux for ARM 64 - Extended Update Support 9.6 aarch64
  • Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.6 ppc64le
  • Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.6 x86_64
  • Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.6 aarch64
  • Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.6 s390x
  • Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 9.6 x86_64
  • Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 9.6 aarch64
  • Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 9.6 ppc64le
  • Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 9.6 s390x

Fixes

  • BZ - 2404720 - CVE-2025-26625 git-lfs: Git LFS may write to arbitrary files via crafted symlinks

Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.6

SRPM
git-lfs-3.6.1-2.el9_6.1.src.rpm SHA-256: 6d2ea575ced87878eba34215d856d0aa4917528a4003b26f8cfd51559f24be02
x86_64
git-lfs-3.6.1-2.el9_6.1.x86_64.rpm SHA-256: 5860c03d0cf44c7b71ad810b4fa1ae717476f0436e759cbd447e58bb156a94a5
git-lfs-debuginfo-3.6.1-2.el9_6.1.x86_64.rpm SHA-256: 2b072d200e9bdc8c2fec9714144fba55c2b6d6dede6b4de9870908f796c3fd97
git-lfs-debugsource-3.6.1-2.el9_6.1.x86_64.rpm SHA-256: bd8fe905a49ddd93745c34c3fd111b2d1ce60afd15bf7a8c480f2695dff86cda

Red Hat Enterprise Linux Server - AUS 9.6

SRPM
git-lfs-3.6.1-2.el9_6.1.src.rpm SHA-256: 6d2ea575ced87878eba34215d856d0aa4917528a4003b26f8cfd51559f24be02
x86_64
git-lfs-3.6.1-2.el9_6.1.x86_64.rpm SHA-256: 5860c03d0cf44c7b71ad810b4fa1ae717476f0436e759cbd447e58bb156a94a5
git-lfs-debuginfo-3.6.1-2.el9_6.1.x86_64.rpm SHA-256: 2b072d200e9bdc8c2fec9714144fba55c2b6d6dede6b4de9870908f796c3fd97
git-lfs-debugsource-3.6.1-2.el9_6.1.x86_64.rpm SHA-256: bd8fe905a49ddd93745c34c3fd111b2d1ce60afd15bf7a8c480f2695dff86cda

Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 9.6

SRPM
git-lfs-3.6.1-2.el9_6.1.src.rpm SHA-256: 6d2ea575ced87878eba34215d856d0aa4917528a4003b26f8cfd51559f24be02
s390x
git-lfs-3.6.1-2.el9_6.1.s390x.rpm SHA-256: 690a61740ae6dfab4866b9d33413772b4d80b0aa9d36dfaeeed3b5058c774a7a
git-lfs-debuginfo-3.6.1-2.el9_6.1.s390x.rpm SHA-256: 0788415cd29d00c7ea84917352b4cb0ea1bfbd7f78207d0065cccdde05f5108c
git-lfs-debugsource-3.6.1-2.el9_6.1.s390x.rpm SHA-256: 933adf73adc5c4ce4149f3de61d8ea57e741dbdff813dcaaa8ce888acb54476a

Red Hat Enterprise Linux for Power, little endian - Extended Update Support 9.6

SRPM
git-lfs-3.6.1-2.el9_6.1.src.rpm SHA-256: 6d2ea575ced87878eba34215d856d0aa4917528a4003b26f8cfd51559f24be02
ppc64le
git-lfs-3.6.1-2.el9_6.1.ppc64le.rpm SHA-256: c2bac37770e691287116d821cc8b978a064c648d226da5fc6900d988cb4919e7
git-lfs-debuginfo-3.6.1-2.el9_6.1.ppc64le.rpm SHA-256: 75c6a826da9eb605b914c9a3269548df9b3f8e5bc6ce851bfc575e0435c41446
git-lfs-debugsource-3.6.1-2.el9_6.1.ppc64le.rpm SHA-256: 1de80b0303230230bbca58b4eb41e236a166ad67494eb4d30a44da0bb6c32ee4

Red Hat Enterprise Linux for ARM 64 - Extended Update Support 9.6

SRPM
git-lfs-3.6.1-2.el9_6.1.src.rpm SHA-256: 6d2ea575ced87878eba34215d856d0aa4917528a4003b26f8cfd51559f24be02
aarch64
git-lfs-3.6.1-2.el9_6.1.aarch64.rpm SHA-256: 19ccbcc291a49e4f955836911466218e14543cf263135fe60bfb11179e6f5ed8
git-lfs-debuginfo-3.6.1-2.el9_6.1.aarch64.rpm SHA-256: 4a215609d5a0c3415f08256bbff9055f60b9dc5591e4cc963d60f00e60787754
git-lfs-debugsource-3.6.1-2.el9_6.1.aarch64.rpm SHA-256: 8b073da285e80d8233f2177679e367d4a4dab463879859d0a73d94b5decc45db

Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.6

SRPM
git-lfs-3.6.1-2.el9_6.1.src.rpm SHA-256: 6d2ea575ced87878eba34215d856d0aa4917528a4003b26f8cfd51559f24be02
ppc64le
git-lfs-3.6.1-2.el9_6.1.ppc64le.rpm SHA-256: c2bac37770e691287116d821cc8b978a064c648d226da5fc6900d988cb4919e7
git-lfs-debuginfo-3.6.1-2.el9_6.1.ppc64le.rpm SHA-256: 75c6a826da9eb605b914c9a3269548df9b3f8e5bc6ce851bfc575e0435c41446
git-lfs-debugsource-3.6.1-2.el9_6.1.ppc64le.rpm SHA-256: 1de80b0303230230bbca58b4eb41e236a166ad67494eb4d30a44da0bb6c32ee4

Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.6

SRPM
git-lfs-3.6.1-2.el9_6.1.src.rpm SHA-256: 6d2ea575ced87878eba34215d856d0aa4917528a4003b26f8cfd51559f24be02
x86_64
git-lfs-3.6.1-2.el9_6.1.x86_64.rpm SHA-256: 5860c03d0cf44c7b71ad810b4fa1ae717476f0436e759cbd447e58bb156a94a5
git-lfs-debuginfo-3.6.1-2.el9_6.1.x86_64.rpm SHA-256: 2b072d200e9bdc8c2fec9714144fba55c2b6d6dede6b4de9870908f796c3fd97
git-lfs-debugsource-3.6.1-2.el9_6.1.x86_64.rpm SHA-256: bd8fe905a49ddd93745c34c3fd111b2d1ce60afd15bf7a8c480f2695dff86cda

Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.6

SRPM
git-lfs-3.6.1-2.el9_6.1.src.rpm SHA-256: 6d2ea575ced87878eba34215d856d0aa4917528a4003b26f8cfd51559f24be02
aarch64
git-lfs-3.6.1-2.el9_6.1.aarch64.rpm SHA-256: 19ccbcc291a49e4f955836911466218e14543cf263135fe60bfb11179e6f5ed8
git-lfs-debuginfo-3.6.1-2.el9_6.1.aarch64.rpm SHA-256: 4a215609d5a0c3415f08256bbff9055f60b9dc5591e4cc963d60f00e60787754
git-lfs-debugsource-3.6.1-2.el9_6.1.aarch64.rpm SHA-256: 8b073da285e80d8233f2177679e367d4a4dab463879859d0a73d94b5decc45db

Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.6

SRPM
git-lfs-3.6.1-2.el9_6.1.src.rpm SHA-256: 6d2ea575ced87878eba34215d856d0aa4917528a4003b26f8cfd51559f24be02
s390x
git-lfs-3.6.1-2.el9_6.1.s390x.rpm SHA-256: 690a61740ae6dfab4866b9d33413772b4d80b0aa9d36dfaeeed3b5058c774a7a
git-lfs-debuginfo-3.6.1-2.el9_6.1.s390x.rpm SHA-256: 0788415cd29d00c7ea84917352b4cb0ea1bfbd7f78207d0065cccdde05f5108c
git-lfs-debugsource-3.6.1-2.el9_6.1.s390x.rpm SHA-256: 933adf73adc5c4ce4149f3de61d8ea57e741dbdff813dcaaa8ce888acb54476a

Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 9.6

SRPM
git-lfs-3.6.1-2.el9_6.1.src.rpm SHA-256: 6d2ea575ced87878eba34215d856d0aa4917528a4003b26f8cfd51559f24be02
x86_64
git-lfs-3.6.1-2.el9_6.1.x86_64.rpm SHA-256: 5860c03d0cf44c7b71ad810b4fa1ae717476f0436e759cbd447e58bb156a94a5
git-lfs-debuginfo-3.6.1-2.el9_6.1.x86_64.rpm SHA-256: 2b072d200e9bdc8c2fec9714144fba55c2b6d6dede6b4de9870908f796c3fd97
git-lfs-debugsource-3.6.1-2.el9_6.1.x86_64.rpm SHA-256: bd8fe905a49ddd93745c34c3fd111b2d1ce60afd15bf7a8c480f2695dff86cda

Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 9.6

SRPM
git-lfs-3.6.1-2.el9_6.1.src.rpm SHA-256: 6d2ea575ced87878eba34215d856d0aa4917528a4003b26f8cfd51559f24be02
aarch64
git-lfs-3.6.1-2.el9_6.1.aarch64.rpm SHA-256: 19ccbcc291a49e4f955836911466218e14543cf263135fe60bfb11179e6f5ed8
git-lfs-debuginfo-3.6.1-2.el9_6.1.aarch64.rpm SHA-256: 4a215609d5a0c3415f08256bbff9055f60b9dc5591e4cc963d60f00e60787754
git-lfs-debugsource-3.6.1-2.el9_6.1.aarch64.rpm SHA-256: 8b073da285e80d8233f2177679e367d4a4dab463879859d0a73d94b5decc45db

Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 9.6

SRPM
git-lfs-3.6.1-2.el9_6.1.src.rpm SHA-256: 6d2ea575ced87878eba34215d856d0aa4917528a4003b26f8cfd51559f24be02
ppc64le
git-lfs-3.6.1-2.el9_6.1.ppc64le.rpm SHA-256: c2bac37770e691287116d821cc8b978a064c648d226da5fc6900d988cb4919e7
git-lfs-debuginfo-3.6.1-2.el9_6.1.ppc64le.rpm SHA-256: 75c6a826da9eb605b914c9a3269548df9b3f8e5bc6ce851bfc575e0435c41446
git-lfs-debugsource-3.6.1-2.el9_6.1.ppc64le.rpm SHA-256: 1de80b0303230230bbca58b4eb41e236a166ad67494eb4d30a44da0bb6c32ee4

Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 9.6

SRPM
git-lfs-3.6.1-2.el9_6.1.src.rpm SHA-256: 6d2ea575ced87878eba34215d856d0aa4917528a4003b26f8cfd51559f24be02
s390x
git-lfs-3.6.1-2.el9_6.1.s390x.rpm SHA-256: 690a61740ae6dfab4866b9d33413772b4d80b0aa9d36dfaeeed3b5058c774a7a
git-lfs-debuginfo-3.6.1-2.el9_6.1.s390x.rpm SHA-256: 0788415cd29d00c7ea84917352b4cb0ea1bfbd7f78207d0065cccdde05f5108c
git-lfs-debugsource-3.6.1-2.el9_6.1.s390x.rpm SHA-256: 933adf73adc5c4ce4149f3de61d8ea57e741dbdff813dcaaa8ce888acb54476a

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.