Fedora 42 — dotnet9.0 — multiple vulnerabilities (8 CVEs) — patch and remediation guide

📖 ~4 min read  •  Source: Fedora update FEDORA-2026-85758358ff

Related CVEs: CVE-2026-32175 CVE-2026-32177 CVE-2026-35433 CVE-2026-42899 CVE-2026-26171 CVE-2026-32178 CVE-2026-32203 CVE-2026-33116

Upstream summary: Update to .NET SDK 9.0.117 and Runtime 9.0.16

Fixes: CVE-2026-32175,CVE-2026-32177,CVE-2026-35433,CVE-2026-42899

Release Notes:

– SDK: https://github.com/dotnet/core/blob/main/release-notes/9.0/9.0.16/9.0.117.md
– Runtime: https://github.com/dotnet/core/blob/main/release-notes/9.0/9.0.16/9.0.16.md

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

On Fedora 42 hosts that have dotnet9.0 installed, operators report behaviour consistent with Fedora update FEDORA-2026-85758358ff: dnf / dnf5 refuses to install or restart affected services, SELinux AVC denials appear in /var/log/audit/audit.log, and — for security-rated advisories — the host is exposed to the vulnerability set above. Impact ranges from a single service-restart loop to wider availability incidents whenever dotnet9.0 sits on the serving path.

Environment & Reproduction

Reproduction targets Fedora 42. Confirm release and the installed package:

cat /etc/fedora-release
cat /etc/os-release
rpm -q dotnet9.0
dnf info dotnet9.0 | head -20
# Fedora 41+ ships dnf5 by default:
dnf5 info dotnet9.0 | head -20

Trigger the workflow that exposes dotnet9.0 — multiple vulnerabilities (8 CVEs) — patch and remediation guide while collecting:

sudo journalctl -u dotnet9.0 -b --no-pager | tail -200
sudo journalctl -xe --no-pager | tail -200
sudo tail -200 /var/log/dnf.log
sudo tail -200 /var/log/dnf5.log
sudo tail -200 /var/log/audit/audit.log
# For an evidence bundle with sosreport:
sudo sosreport --batch

Root Cause Analysis

Root cause is documented in Fedora update FEDORA-2026-85758358ff. Fedora packagers shipped fixes in the corresponding dotnet9.0 update for Fedora 42; running an outdated build leaves the host exposed to the failure modes described in the advisory. Correlate dnf history with system logs:

sudo dnf history | head
sudo dnf history list dotnet9.0
sudo dnf history info <id>
sudo dnf5 history list                       # Fedora 41+
sudo ausearch -m AVC,USER_AVC -ts today | tail -100
cat /proc/sys/kernel/tainted   # non-zero = tainted kernel / out-of-tree modules

Quick Triage

Run these on Fedora 42 to capture the current state of dotnet9.0:

rpm -q dotnet9.0                              # installed NVR
rpm -V dotnet9.0                              # verify shipped files
sudo dnf check-update --security
sudo dnf updateinfo list cves
sudo dnf5 check-upgrade --security        # Fedora 41+
systemctl --failed --no-pager
sudo firewall-cmd --list-all
getenforce && sestatus
# If dotnet9.0 ships a systemd unit (unit name may differ from pkg name, e.g.
# bind→named, postgresql-server→postgresql, php-fpm→php-fpm):
systemctl list-unit-files | grep -i dotnet9.0 | head

Step-by-Step Diagnosis

1. List failed systemd units.

   systemctl --failed --no-pager

2. Tail the journal for dotnet9.0 and the system bus.

   sudo journalctl -u dotnet9.0 -f --no-pager
   sudo journalctl -xe -f --no-pager

3. Inspect firewall posture.

   sudo firewall-cmd --list-all-zones --permanent
   sudo nft list ruleset 2>/dev/null | head -50

4. Surface SELinux denials and author a local policy module if needed.

   sudo ausearch -m AVC,USER_AVC -ts today
   sudo ausearch -m AVC -ts today | audit2allow -a -M /tmp/local-fix
   sudo semodule -i /tmp/local-fix.pp

5. Verify dotnet9.0 integrity and reinstall if anything is altered.

   sudo rpm -V dotnet9.0
   sudo dnf reinstall dotnet9.0
   sudo dnf5 reinstall dotnet9.0                 # Fedora 41+

6. Correlate findings with /var/log/dnf.log, dnf history, and Fedora update FEDORA-2026-85758358ff to pin the change that introduced dotnet9.0 — multiple vulnerabilities (8 CVEs) — patch and remediation guide.

Solution – Primary Fix

Before changing system packages on a btrfs-rooted Fedora 42 host take a cheap snapshot so a bad upgrade can be rolled back in seconds:

sudo btrfs subvolume snapshot / /.snapshots/pre-upgrade-$(date +%s)
sudo btrfs subvolume list / | tail

Apply the corrective dnf transaction referenced by Fedora update FEDORA-2026-85758358ff, then reload affected systemd units:

sudo dnf -y makecache
sudo dnf -y upgrade --security              # apply ALL security errata (recommended)
# Fedora 41+ ships dnf5 by default — equivalent commands:
sudo dnf5 upgrade --refresh
sudo dnf5 upgrade-minimal --security
# Or target a single package:
sudo dnf -y upgrade dotnet9.0
sudo dnf5 upgrade dotnet9.0                     # Fedora 41+
sudo systemctl daemon-reload
# Unit name may differ from pkg name; check first:
systemctl list-unit-files | grep -i dotnet9.0 | head
sudo systemctl restart dotnet9.0
rpm -q dotnet9.0                                # confirm new NVR
systemctl is-active dotnet9.0 2>/dev/null       # confirm running (if a unit exists)

For kernel / glibc / systemd / openssl advisories a reboot is required (or kpatch where licensed):

sudo dnf needs-restarting -r                 # report whether reboot needed
sudo systemctl reboot                        # or: sudo shutdown -r now
# kpatch (where licensed) avoids reboot for many kernel CVEs:
sudo dnf install -y kpatch kpatch-dnf
sudo dnf kpatch auto                         # enable auto-patching
sudo kpatch list

Solution – Alternative Approaches

If the primary patch is not viable, choose from these:

• Roll back the offending dnf transaction:

  sudo dnf history list | head
  sudo dnf history info <id>
  sudo dnf history undo <id>
  sudo dnf5 history undo <id>                  # Fedora 41+

• Version-lock the package so dnf cannot upgrade it:

  sudo dnf install -y python3-dnf-plugin-versionlock
  sudo dnf versionlock add dotnet9.0
  sudo dnf versionlock list
  sudo dnf versionlock delete dotnet9.0      # remove the lock

• Install an older NVR if a regression is suspected:

  dnf --showduplicates list dotnet9.0 | tac | head
  sudo dnf install -y --allowerasing dotnet9.0-<older-NVR>

• Switch SELinux to permissive briefly to confirm policy is the cause, then re-enforce:

  sudo setenforce 0
  # reproduce, capture denials, author a custom module:
  sudo ausearch -m AVC -ts recent | audit2allow -a -M mylocal
  sudo semodule -i mylocal.pp
  sudo setenforce 1

• Roll back via a btrfs snapshot taken before the upgrade (Fedora default root filesystem):

  sudo btrfs subvolume list /
  # boot a rescue / live image, then promote the snapshot to /:
  sudo btrfs subvolume snapshot /.snapshots/pre-upgrade-<ts> /root-restored
  # update /etc/fstab and the bootloader to point at the restored subvolume.

• Where kpatch is available, apply kernel fixes without reboot:

  sudo kpatch list
  sudo kpatch load /usr/lib/modules/$(uname -r)/extra/kpatch/*.ko

Verification & Acceptance Criteria

All of these should pass after the fix:

rpm -q dotnet9.0                                            # expected fixed NVR
sudo dnf updateinfo list cves --installed               # CVEs above no longer listed
systemctl is-active dotnet9.0 2>/dev/null
sudo journalctl -u dotnet9.0 --since "5 minutes ago" --no-pager | grep -iE "error|fail" || echo OK
sudo firewall-cmd --list-services
getenforce
sudo dnf needs-restarting -r

The original reproduction for dotnet9.0 — multiple vulnerabilities (8 CVEs) — patch and remediation guide must not trigger across two consecutive runs.

Rollback Plan

Capture state before any change:

rpm -qa > /root/rpm-pre.txt
sudo dnf history list > /root/dnf-history-pre.txt
# Cheap btrfs snapshot of the root subvolume:
sudo btrfs subvolume snapshot / /.snapshots/pre-upgrade-$(date +%s)

To revert if the patch is bad:

sudo dnf history undo <id>
sudo dnf5 history undo <id>                  # Fedora 41+
# Or downgrade just the package:
sudo dnf install -y --allowerasing dotnet9.0-<older-NVR>
sudo systemctl daemon-reload
sudo systemctl restart dotnet9.0
# Or boot rescue and promote the btrfs snapshot back to /.
# Custom SELinux policy cleanup:
sudo semodule -r mylocal

Prevention & Hardening

Reduce the chance of this recurring on Fedora 42:

• Enable automatic security patching with dnf-automatic:

  sudo dnf install -y dnf-automatic
  sudo sed -i 's/^upgrade_type.*/upgrade_type = security/' /etc/dnf/automatic.conf
  sudo sed -i 's/^apply_updates.*/apply_updates = yes/' /etc/dnf/automatic.conf
  sudo systemctl enable --now dnf-automatic.timer
  sudo systemctl enable --now dnf-automatic-install.timer
  dnf updateinfo list cves --available

• Subscribe to fedora-announce and watch the Bodhi security updates feed for upstream changes.

• Mirror through a local repo for controlled rollouts:

  sudo dnf install -y dnf-utils createrepo_c
  sudo reposync --download-metadata --downloadcomps -p /srv/mirror --repoid=fedora
  sudo createrepo_c /srv/mirror/fedora

• Version-lock sensitive packages so they cannot be auto-upgraded:

  sudo dnf install -y python3-dnf-plugin-versionlock
  sudo dnf versionlock add dotnet9.0

• Monitor file integrity with AIDE:

  sudo dnf install -y aide
  sudo aide --init && sudo mv /var/lib/aide/aide.db.new.gz /var/lib/aide/aide.db.gz
  sudo aide --check

• Enable kpatch (where available) so kernel CVEs can be remediated without reboot:

  sudo dnf install -y kpatch kpatch-dnf
  sudo dnf kpatch auto
  sudo kpatch list

• Keep SELinux in enforcing mode and review custom modules in /etc/selinux/targeted/ after every package upgrade.

• Apply CIS Fedora 42 Benchmark hardening and remove unused packages.

Related Errors & Cross-Refs

Issues that commonly surface alongside dotnet9.0 — multiple vulnerabilities (8 CVEs) — patch and remediation guide: dnf lock contention, systemd unit ordering cycles, SELinux AVC bursts, firewalld zone drift, and kernel taint flags. Useful triage:

sudo dnf check
systemd-analyze critical-chain
sudo ausearch -m AVC -ts today | tail
sudo firewall-cmd --get-active-zones
cat /proc/sys/kernel/tainted
sudo dnf needs-restarting -r

View all fedora-42 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

Primary reference: Fedora update FEDORA-2026-85758358ff. Manual pages useful on Fedora 42:

man dnf
man dnf5
man dnf.conf
man systemctl
man journalctl
man firewall-cmd
man semanage
man audit2allow
man kpatch
man sosreport
man btrfs

Other resources: docs.fedoraproject.org, Bodhi update system, Red Hat CVE database, and per-package notes in /usr/share/doc/dotnet9.0/ for components implicated in dotnet9.0 — multiple vulnerabilities (8 CVEs) — patch and remediation guide.

View all Fedora 42 tutorials on the Tutorials Hub →