RLSA-2026:98635: Important: xdg-dbus-proxy security update
xdg-dbus-proxy is a filtering proxy for D-Bus connections. It was originally part of the flatpak project, but it has been broken out as a standalone module to facilitate using it in other contexts.
Security Fix(es):
xdg-dbus-proxy: xdg-dbus-proxy: message filtering bypass via reply serial allows sandbox escape (CVE-2026-94422)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rocky-linux/xdg-dbus-proxy-debuginfoto a version that resolves this vulnerability.Fixed in 0:0.1.5-4.el10_2.1 - Upgrade
Upgrade
rocky-linux/xdg-dbus-proxy-debugsourceto a version that resolves this vulnerability.Fixed in 0:0.1.5-4.el10_2.1 - Upgrade
Upgrade
rocky-linux/xdg-dbus-proxyto a version that resolves this vulnerability.Fixed in 0:0.1.5-4.el10_2.1
Event History
Frequently Asked Questions
What component or deployment types are relevant to this issue?
The issue affects xdg-dbus-proxy, a filtering proxy for D-Bus connections. It is relevant both to its use with Flatpak and to other contexts where the standalone module is deployed.
What is the security impact of successful exploitation?
The vulnerability is a message-filtering bypass involving reply serials that can allow a sandbox escape.