RHSA-2026:98112: Important: flatpak security update
Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.Security Fix(es): flatpak: Flatpak: Arbitrary code execution via missing symlink protection (CVE-2026-90616) flatpak: flatpak: Arbitrary write access as root via extra-data extraction (CVE-2026-96275) flatpak: flatpak: Buffer overflow in OCI delta stream path names on 32-bit systems (CVE-2026-96280) flatpak: Flatpak: Local privilege escalation via symlink traversal in revokefs writer (CVE-2026-96808) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/flatpakto a version that resolves this vulnerability.Fixed in 1.12.9-2.el8_4.1 - Upgrade
Upgrade
redhat/flatpak-debuginfoto a version that resolves this vulnerability.Fixed in 1.12.9-2.el8_4.1 - Upgrade
Upgrade
redhat/flatpak-debugsourceto a version that resolves this vulnerability.Fixed in 1.12.9-2.el8_4.1 - Upgrade
Upgrade
redhat/flatpak-libsto a version that resolves this vulnerability.Fixed in 1.12.9-2.el8_4.1 - Upgrade
Upgrade
redhat/flatpak-libs-debuginfoto a version that resolves this vulnerability.Fixed in 1.12.9-2.el8_4.1 - Upgrade
Upgrade
redhat/flatpak-selinuxto a version that resolves this vulnerability.Fixed in 1.12.9-2.el8_4.1 - Upgrade
Upgrade
redhat/flatpak-session-helperto a version that resolves this vulnerability.Fixed in 1.12.9-2.el8_4.1 - Upgrade
Upgrade
redhat/flatpak-session-helper-debuginfoto a version that resolves this vulnerability.Fixed in 1.12.9-2.el8_4.1 - Upgrade
Upgrade
redhat/flatpak-tests-debuginfoto a version that resolves this vulnerability.Fixed in 1.12.9-2.el8_4.1
Event History
Frequently Asked Questions
Which systems are most exposed to these issues?
Systems running Flatpak are affected by the flaws addressed in this update. The listed issues include arbitrary code execution, root-level arbitrary file writes, and local privilege escalation; the buffer-overflow issue specifically affects 32-bit systems handling OCI delta stream path names.
What level of access does an attacker need?
The advisory identifies a local privilege-escalation issue and issues involving symlink handling and extra-data extraction, but it does not specify the exact prerequisites or attack path for each CVE. The OCI delta stream buffer overflow is associated with processing crafted path names on 32-bit systems.
How can I determine whether I need to apply the update?
Review whether Flatpak or its associated packages are installed, including flatpak-libs and flatpak-session-helper. If Flatpak is present, apply RHSA-2026:98112; the advisory does not provide affected or fixed package version numbers.