RHSA-2026:95493: Important: flatpak security update

Q: Which systems are most exposed to these issues?

Systems with Flatpak installed are in scope. The buffer-overflow issue specifically affects 32-bit systems, while the other listed issues involve arbitrary code execution, root-level writes, or local privilege escalation.

Q: What level of access would an attacker need?

The advisory identifies a local privilege-escalation issue and flaws involving symlink handling and extra-data extraction, but it does not specify all prerequisites or attack paths. Review the referenced CVE material for exploit conditions.

Q: Are debug and development-related Flatpak packages included?

Yes. The affected software list includes flatpak-debuginfo, flatpak-debugsource, flatpak-libs-debuginfo, flatpak-session-helper-debuginfo, and flatpak-tests-debuginfo, in addition to Flatpak and flatpak-libs.

Q: How can I determine whether a system is affected?

Check whether any of the listed Red Hat Flatpak packages are installed, including flatpak and flatpak-libs. The supplied data does not include fixed package versions, so compare installed packages with the update provided by RHSA-2026:95493.

Published Nov 5, 2026

Updated

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.Security Fix(es): flatpak: Flatpak: Arbitrary code execution via missing symlink protection (CVE-2026-90616) flatpak: flatpak: Arbitrary write access as root via extra-data extraction (CVE-2026-96275) flatpak: flatpak: Buffer overflow in OCI delta stream path names on 32-bit systems (CVE-2026-96280) flatpak: Flatpak: Local privilege escalation via symlink traversal in revokefs writer (CVE-2026-96808) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Affected Software

18 affected componentsFixes available

Red Hat Red Hat Enterprise Linux for x86_64 - Extended Life Cycle Long Life

Red Hat Red Hat Enterprise Linux Server - AUS

redhat/flatpak<1.12.9-1.el8_6.1

1.12.9-1.el8_6.1

redhat/flatpak<1.12.9-1.el8_6.1

1.12.9-1.el8_6.1

redhat/flatpak-debuginfo<1.12.9-1.el8_6.1

1.12.9-1.el8_6.1

redhat/flatpak-debuginfo<1.12.9-1.el8_6.1

1.12.9-1.el8_6.1

redhat/flatpak-debugsource<1.12.9-1.el8_6.1

1.12.9-1.el8_6.1

redhat/flatpak-debugsource<1.12.9-1.el8_6.1

1.12.9-1.el8_6.1

redhat/flatpak-libs<1.12.9-1.el8_6.1

1.12.9-1.el8_6.1

redhat/flatpak-libs<1.12.9-1.el8_6.1

1.12.9-1.el8_6.1

redhat/flatpak-libs-debuginfo<1.12.9-1.el8_6.1

1.12.9-1.el8_6.1

redhat/flatpak-libs-debuginfo<1.12.9-1.el8_6.1

1.12.9-1.el8_6.1

redhat/flatpak-selinux<1.12.9-1.el8_6.1

1.12.9-1.el8_6.1

redhat/flatpak-session-helper<1.12.9-1.el8_6.1

1.12.9-1.el8_6.1

redhat/flatpak-session-helper-debuginfo<1.12.9-1.el8_6.1

1.12.9-1.el8_6.1

redhat/flatpak-session-helper-debuginfo<1.12.9-1.el8_6.1

1.12.9-1.el8_6.1

redhat/flatpak-tests-debuginfo<1.12.9-1.el8_6.1

1.12.9-1.el8_6.1

redhat/flatpak-tests-debuginfo<1.12.9-1.el8_6.1

1.12.9-1.el8_6.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade redhat/flatpak to a version that resolves this vulnerability.
Fixed in 1.12.9-1.el8_6.1
Upgrade
Upgrade redhat/flatpak-debuginfo to a version that resolves this vulnerability.
Fixed in 1.12.9-1.el8_6.1
Upgrade
Upgrade redhat/flatpak-debugsource to a version that resolves this vulnerability.
Fixed in 1.12.9-1.el8_6.1
Upgrade
Upgrade redhat/flatpak-libs to a version that resolves this vulnerability.
Fixed in 1.12.9-1.el8_6.1
Upgrade
Upgrade redhat/flatpak-libs-debuginfo to a version that resolves this vulnerability.
Fixed in 1.12.9-1.el8_6.1
Upgrade
Upgrade redhat/flatpak-selinux to a version that resolves this vulnerability.
Fixed in 1.12.9-1.el8_6.1
Upgrade
Upgrade redhat/flatpak-session-helper to a version that resolves this vulnerability.
Fixed in 1.12.9-1.el8_6.1
Upgrade
Upgrade redhat/flatpak-session-helper-debuginfo to a version that resolves this vulnerability.
Fixed in 1.12.9-1.el8_6.1
Upgrade
Upgrade redhat/flatpak-tests-debuginfo to a version that resolves this vulnerability.
Fixed in 1.12.9-1.el8_6.1

Event History

Nov 5, 2026

Advisory Published

via Red Hat·12:00 AM

Data Sourced

via Red Hat·12:00 AM

RemedyDescriptionAffected Software

Advisory Published

via Red Hat·09:34 AM

Data Sourced

via Red Hat·09:34 AM

Severity

Frequently Asked Questions

Which systems are most exposed to these issues?

Systems with Flatpak installed are in scope. The buffer-overflow issue specifically affects 32-bit systems, while the other listed issues involve arbitrary code execution, root-level writes, or local privilege escalation.

What level of access would an attacker need?

The advisory identifies a local privilege-escalation issue and flaws involving symlink handling and extra-data extraction, but it does not specify all prerequisites or attack paths. Review the referenced CVE material for exploit conditions.

Are debug and development-related Flatpak packages included?

Yes. The affected software list includes flatpak-debuginfo, flatpak-debugsource, flatpak-libs-debuginfo, flatpak-session-helper-debuginfo, and flatpak-tests-debuginfo, in addition to Flatpak and flatpak-libs.

How can I determine whether a system is affected?

Check whether any of the listed Red Hat Flatpak packages are installed, including flatpak and flatpak-libs. The supplied data does not include fixed package versions, so compare installed packages with the update provided by RHSA-2026:95493.

RHSA-2026:95493: Important: flatpak security update

Affected Software

Remediation

Event History

Frequently Asked Questions

Which systems are most exposed to these issues?

What level of access would an attacker need?

Are debug and development-related Flatpak packages included?

How can I determine whether a system is affected?

Company

Resources

Contact

Frequently Asked Questions

Which systems are most exposed to these issues?

What level of access would an attacker need?

Are debug and development-related Flatpak packages included?

How can I determine whether a system is affected?