Security fix for CVE-2026-39881
Updates may require up to 24 hours to propagate to mirrors. If the following command doesn't work, please retry later:
sudo dnf upgrade --refresh --advisory=FEDORA-2026-755c51e6a0
Please log in to add feedback.
This update has been submitted for testing by zdohnal.
This update's test gating status has been changed to 'waiting'.
This update's test gating status has been changed to 'failed'.
This update's test gating status has been changed to 'waiting'.
This update's test gating status has been changed to 'waiting'.
This update's test gating status has been changed to 'passed'.
This update has been pushed to testing.
Working for me.
Works great! LGTM! =)
This update can be pushed to stable now if the maintainer wishes
This update has been submitted for stable by bodhi.
Works
This update has been pushed to stable.
I don't know where the most appropriate location to put such an important upgrade notice is, but... Upstream vim-9.2-390 made a significant change to modeline behavior: a new option 'modelinestrict' was added that only allows options from a specific set to be recognized. The default for that new option is enabled. So, if you have a modeline containing something innocuous like 'ignorecase' it will be ignored! I'm not sure why on earth 'ignorecase' is not in the allowed list...
Please advise on where in the fedora update ecosystem that such a notice can be placed. People like myself who try to stay fairly up-to-date suddenly had to spend a couple of hours tracing down why various modeline options were no longer working. This is not ideal behavior, as my initial response to the problem was to downgrade and stop updating!
This morning I finally spent time analyzing what else changed (based the CVE bugfix) to the vim-9.2 package that would BREAK modeline.
Partial relevant diffs between vim-9.2.280-1 and vim-9.2.390-1: From vim92/runtime/doc/version9.txt: +- Only a few whitelisted options are allowed to be set by a modeline to + improve overall security, see for details: 'modelinestrict' +- Removed the Wayland focus steal feature 'wlsteal', since it causes too many + issues and can now be re-implemted using the |clipboard-providers| feature + if needed, see |wayland-primary-selection| for an example.
From vim92/runtime/doc/options.txt: @@ -6195,6 +6199,48 @@ NOTE: 'modeline' is set to the Vi default value when 'compatible' is set and to the Vim default value when 'compatible' is reset.