CVE-2026-97029: Flatpak: flatpak: sandboxed app can signal unsandboxed processes in the same process group
Flatpak's process ID namespace separation does not prevent a sandboxed app's kill(0, signal) or killpg(0, signal) calls from reaching processes outside the sandbox that share the same process group. A malicious or compromised Flatpak app can use this to cause denial of service by terminating processes outside its sandbox, such as the desktop shell.
Other sources
GHSA-f3p8-vr7v-gxf2 (https://github.com/flatpak/flatpak/security/advisories/GHSA-f3p8-vr7v-gxf2)
Description: If a sandboxed app calls kill(0, signal) or killpg(0, signal), process ID namespace separation does not prevent the signal from being received by every process in the current process group, even though some of those processes are outside the process ID namespace. A malicious or compromised Flatpak app can cause denial of service by terminating processes outside its sandbox. For example, when running under GNOME Shell, the Flatpak app can terminate the shell, causing the desktop session to end. If processes in the same process group take an unsafe action on receiving a signal (e.g. SIGUSR1 puts them into a mode that exposes additional attack surface), a malicious or compromised app could trigger this.
Mitigation: Run Flatpak apps in a new session (setsid flatpak run ...) or a new process group (setpgid(0, 0) in the parent), or avoid running untrusted Flatpak apps. Patched in 1.18.4 by commit a3cf27b5 ("common: Put each bubblewrap child process in its own process group"). Credit: Reported by Guthrie Armstrong, Coalition, Inc.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Flatpakto a version that resolves this vulnerability.Fixed in 1.18.4 - Compensating control
Run Flatpak apps in a new session using `setsid flatpak run ...` or in a new process group using `setpgid(0, 0)` in the parent; alternatively, avoid running untrusted Flatpak apps.
Event History
Frequently Asked Questions
What must an attacker control to exploit this issue?
The attacker must be able to run a malicious or compromised Flatpak application. Exploitation requires the app to invoke kill(0, signal) or killpg(0, signal), which affects processes in its current process group.
Who is exposed to the denial-of-service impact?
Systems where a Flatpak app shares a process group with processes outside the sandbox are exposed. Under GNOME Shell, a malicious app can terminate the shell and end the desktop session.
Can this affect more than availability?
The stated direct impact is denial of service. However, if another process in the shared process group performs an unsafe action when receiving a signal, such as SIGUSR1, the app could trigger behavior that exposes additional attack surface.