RLSA-2026:98595: Important: flatpak security update
Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.
Security Fix(es):
flatpak: Flatpak: Arbitrary code execution via missing symlink protection (CVE-2026-90616)
flatpak: flatpak: Arbitrary write access as root via extra-data extraction (CVE-2026-96275)
flatpak: flatpak: Buffer overflow in OCI delta stream path names on 32-bit systems (CVE-2026-96280)
flatpak: Flatpak: Local privilege escalation via symlink traversal in revokefs writer (CVE-2026-96808)
flatpak: flatpak: Arbitrary file deletion in root context via path traversal in deploy directory export/bin (CVE-2026-97023)
flatpak: flatpak: Arbitrary write in root context via path traversal in deploy directory files/etc (CVE-2026-97024)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rocky-linux/flatpak-debugsourceto a version that resolves this vulnerability.Fixed in 0:1.18.0-2.el10_3.4 - Upgrade
Upgrade
rocky-linux/flatpak-libsto a version that resolves this vulnerability.Fixed in 0:1.18.0-2.el10_3.4 - Upgrade
Upgrade
rocky-linux/flatpak-debuginfoto a version that resolves this vulnerability.Fixed in 0:1.18.0-2.el10_3.4 - Upgrade
Upgrade
rocky-linux/flatpak-session-helperto a version that resolves this vulnerability.Fixed in 0:1.18.0-2.el10_3.4 - Upgrade
Upgrade
rocky-linux/flatpak-session-helper-debuginfoto a version that resolves this vulnerability.Fixed in 0:1.18.0-2.el10_3.4 - Upgrade
Upgrade
rocky-linux/flatpak-libs-debuginfoto a version that resolves this vulnerability.Fixed in 0:1.18.0-2.el10_3.4 - Upgrade
Upgrade
rocky-linux/flatpak-develto a version that resolves this vulnerability.Fixed in 0:1.18.0-2.el10_3.4 - Upgrade
Upgrade
rocky-linux/flatpakto a version that resolves this vulnerability.Fixed in 0:1.18.0-2.el10_3.4 - Upgrade
Upgrade
rocky-linux/flatpak-selinuxto a version that resolves this vulnerability.Fixed in 0:1.18.0-2.el10_3.4
Event History
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
Which Rocky Linux Flatpak packages are covered by this advisory?
The advisory covers flatpak, flatpak-libs, flatpak-session-helper, flatpak-devel, flatpak-debugsource, flatpak-debuginfo, flatpak-libs-debuginfo, and flatpak-session-helper-debuginfo.
Are any of the fixes specific to 32-bit systems?
Yes. CVE-2026-96280 is a buffer overflow in OCI delta stream path names that is identified as affecting 32-bit systems.
What types of security impact are addressed beyond code execution?
The fixes also address local privilege escalation, arbitrary root-context file writes and deletion, and path traversal or symlink-traversal conditions. The listed weakness categories include buffer overflow and path traversal.