Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Flatpak could let apps write files outside its sandbox
published 24 days ago
Summary
Flatpak on AlmaLinux could allow a sandboxed application to replace its own library cache directory with a link, causing the app to write files anywhere on the host system. This could be used to alter or create files outside the intended safe area. Update Flatpak packages to the latest version to apply the fix.
What to do
- Update almalinux flatpak to version 1.12.9-4.el9_6.tuxcare.els5.
- Update almalinux flatpak-devel to version 1.12.9-4.el9_6.tuxcare.els5.
- Update almalinux flatpak-libs to version 1.12.9-4.el9_6.tuxcare.els5.
- Update almalinux flatpak-selinux to version 1.12.9-4.el9_6.tuxcare.els5.
- Update almalinux flatpak-session-helper to version 1.12.9-4.el9_6.tuxcare.els5.
- Update almalinux flatpak-tests to version 1.12.9-4.el9_6.tuxcare.els5.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| TuxCare:AlmaLinux:9.6 | almalinux | flatpak |
< 1.12.9-4.el9_6.tuxcare.els5 Fix: upgrade to 1.12.9-4.el9_6.tuxcare.els5
|
| TuxCare:AlmaLinux:9.6 | almalinux | flatpak-devel |
< 1.12.9-4.el9_6.tuxcare.els5 Fix: upgrade to 1.12.9-4.el9_6.tuxcare.els5
|
| TuxCare:AlmaLinux:9.6 | almalinux | flatpak-libs |
< 1.12.9-4.el9_6.tuxcare.els5 Fix: upgrade to 1.12.9-4.el9_6.tuxcare.els5
|
| TuxCare:AlmaLinux:9.6 | almalinux | flatpak-selinux |
< 1.12.9-4.el9_6.tuxcare.els5 Fix: upgrade to 1.12.9-4.el9_6.tuxcare.els5
|
| TuxCare:AlmaLinux:9.6 | almalinux | flatpak-session-helper |
< 1.12.9-4.el9_6.tuxcare.els5 Fix: upgrade to 1.12.9-4.el9_6.tuxcare.els5
|
| TuxCare:AlmaLinux:9.6 | almalinux | flatpak-tests |
< 1.12.9-4.el9_6.tuxcare.els5 Fix: upgrade to 1.12.9-4.el9_6.tuxcare.els5
|
Original advisory text
flatpak: Fix of CVE-2026-96807
- CVE-2026-96807: regenerate_ld_cache() created and bind-mounted the
per-app .ld.so directory by path, and flatpak_switch_symlink_and_remove()
swapped its "active" symlink with path-based symlink()/rename()/unlink(),
so a sandboxed app could replace ~/.var/app/$APPID/.ld.so with a symlink
and have ld.so cache files written at an arbitrary host location;
regenerate_ld_cache() now opens the directory with
glnx_chase_and_mkdirat(), works on it with *at() syscalls and passes it
to bwrap with --bind-fd, and flatpak_switch_symlink_and_remove() takes
the directory fd and uses symlinkat()/renameat()/unlinkat()
- Fix flatpak_switch_symlink_and_remove() returning -1 (truthy) instead of
FALSE on one error path
per-app .ld.so directory by path, and flatpak_switch_symlink_and_remove()
swapped its "active" symlink with path-based symlink()/rename()/unlink(),
so a sandboxed app could replace ~/.var/app/$APPID/.ld.so with a symlink
and have ld.so cache files written at an arbitrary host location;
regenerate_ld_cache() now opens the directory with
glnx_chase_and_mkdirat(), works on it with *at() syscalls and passes it
to bwrap with --bind-fd, and flatpak_switch_symlink_and_remove() takes
the directory fd and uses symlinkat()/renameat()/unlinkat()
- Fix flatpak_switch_symlink_and_remove() returning -1 (truthy) instead of
FALSE on one error path
References
- https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1791735057.html Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-96807 Vendor Advisory
Timeline
Published11 Oct 2026
Updated26 Oct 2026
First seen26 Oct 2026
Sources
CLSA-2026-1791735057 · OSV
Track software like this
Free during beta