RLSA-2026:98490: Important: flatpak security update
Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.
Security Fix(es):
flatpak: Flatpak: Arbitrary code execution via missing symlink protection (CVE-2026-90616)
flatpak: flatpak: Arbitrary write access as root via extra-data extraction (CVE-2026-96275)
flatpak: flatpak: Buffer overflow in OCI delta stream path names on 32-bit systems (CVE-2026-96280)
flatpak: Flatpak: Local privilege escalation via symlink traversal in revokefs writer (CVE-2026-96808)
flatpak: flatpak: Arbitrary file deletion in root context via path traversal in deploy directory export/bin (CVE-2026-97023)
flatpak: flatpak: Arbitrary write in root context via path traversal in deploy directory files/etc (CVE-2026-97024)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rocky-linux/flatpakto a version that resolves this vulnerability.Fixed in 0:1.12.9-6.el9_9.5 - Upgrade
Upgrade
rocky-linux/flatpak-debuginfoto a version that resolves this vulnerability.Fixed in 0:1.12.9-6.el9_9.5 - Upgrade
Upgrade
rocky-linux/flatpak-debugsourceto a version that resolves this vulnerability.Fixed in 0:1.12.9-6.el9_9.5 - Upgrade
Upgrade
rocky-linux/flatpak-develto a version that resolves this vulnerability.Fixed in 0:1.12.9-6.el9_9.5 - Upgrade
Upgrade
rocky-linux/flatpak-libsto a version that resolves this vulnerability.Fixed in 0:1.12.9-6.el9_9.5 - Upgrade
Upgrade
rocky-linux/flatpak-libs-debuginfoto a version that resolves this vulnerability.Fixed in 0:1.12.9-6.el9_9.5 - Upgrade
Upgrade
rocky-linux/flatpak-session-helperto a version that resolves this vulnerability.Fixed in 0:1.12.9-6.el9_9.5 - Upgrade
Upgrade
rocky-linux/flatpak-session-helper-debuginfoto a version that resolves this vulnerability.Fixed in 0:1.12.9-6.el9_9.5 - Upgrade
Upgrade
rocky-linux/flatpak-selinuxto a version that resolves this vulnerability.Fixed in 0:1.12.9-6.el9_9.5
Event History
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
Does any listed issue have a platform-specific condition?
Yes. CVE-2026-96280 is described as a buffer overflow in OCI delta stream path names on 32-bit systems.
What does the supplied severity vector indicate about attacker interaction and privileges?
The advisory rates the update high at 8.8 and provides the vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. This indicates network attack vector, low attack complexity, no required privileges, and required user interaction for the scored issue set.
Which Flatpak package variants are included in the update scope?
The advisory covers flatpak, flatpak-debuginfo, flatpak-debugsource, flatpak-devel, flatpak-libs, flatpak-libs-debuginfo, flatpak-session-helper, and flatpak-session-helper-debuginfo for Rocky Linux.