CVE-2026-76925: Flatpak: flatpak: toctou race condition allows symlink redirection
A flaw was found in Flatpak. A Time-of-check to time-of-use (TOCTOU) race condition exists in the org.freedesktop.Flatpak.SystemHelper component. This vulnerability occurs because a privileged chmod operation executes before the OSTree repository validation within the Deploy() function. An attacker can exploit this timing window to redirect symlinks to arbitrary files, potentially leading to unauthorized file manipulation or information disclosure.
Affected Software
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The attacker needs local access and low privileges. Exploitation also requires winning a high-complexity timing race; no user interaction is required.
Which component is involved in the vulnerable operation?
The issue is in the org.freedesktop.Flatpak.SystemHelper component, specifically during the Deploy() function. A privileged chmod operation occurs before OSTree repository validation.
What could successful exploitation allow?
An attacker may redirect symlinks to arbitrary files during the race window. This can result in unauthorized file manipulation or information disclosure.