Debian Fixes Root Command Execution in NetworkManager Iodine Plugin
Tech GuruQuick Answer
Inventory Debian trixie systems using network-manager-iodine and update to 1.2.0-3.3+deb13u1. Validate connection settings and VPN behavior after maintenance.
Confirm Scope And Apply The Supported Remediation
What to do now: Identify trixie workstations and servers with network-manager-iodine installed; record package versions, connection-profile ownership and local-user access. Match the package and distribution to DSA-6629-1. The attack described requires a local unprivileged user; do not present it as unauthenticated internet-facing exploitation. Install network-manager-iodine 1.2.0-3.3+deb13u1 from the Debian trixie security repository using the normal package-maintenance workflow. Confirm the installed package, review approved nameserver settings and test iodine VPN connection establishment. Preserve package logs, configuration records and post-update results.
Last verified: 2026-11-15 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | Debian 13 trixie network-manager-iodine package |
|---|---|
| Advisory | DSA-6629-1 |
| CVE | CVE-2026-91837 |
| Authoritative release date | 2026-11-14 17:41:43 UTC — Debian security announcement message header. The advisory heading and feed carry November 15, 2026; both dates are retained. |
| Authority revision date | No separate advisory revision date is supplied. |
| Affected versions | Debian trixie network-manager-iodine before 1.2.0-3.3+deb13u1. An unprivileged local user can exploit insufficient nameserver-setting validation during connection establishment before privileges are dropped. |
| Fixed version | Debian trixie network-manager-iodine 1.2.0-3.3+deb13u1 |
| CVSS base score | Not provided by the authority |
| CVSS severity | Not provided by the authority |
| Exploitation status | Debian does not confirm exploitation in the wild in this advisory.; no exploitation claim is inferred. |
What Changed
Debian issued DSA-6629-1 to correct nameserver-setting validation in the iodine VPN plugin for NetworkManager. The flaw can allow a local unprivileged user to execute commands as root before the service drops privileges.
What To Validate Now
- Inventory. Identify trixie workstations and servers with network-manager-iodine installed; record package versions, connection-profile ownership and local-user access.
- Establish applicability. Match the package and distribution to DSA-6629-1. The attack described requires a local unprivileged user; do not present it as unauthenticated internet-facing exploitation.
- Remediate. Install network-manager-iodine 1.2.0-3.3+deb13u1 from the Debian trixie security repository using the normal package-maintenance workflow.
- Validate. Confirm the installed package, review approved nameserver settings and test iodine VPN connection establishment. Preserve package logs, configuration records and post-update results.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
Coordinate network changes with users and remote-access owners. The bulletin covers trixie; the tracker still lists bookworm as vulnerable, so this trixie package must not be presented as a fix for bookworm.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
