Skip to content
OpenAdvisories
Medium · 5.8 CVE-2026-76925 EUVD-2026-71774GHSA-639f-3fwc-hmpx

Flatpak: flatpak: toctou race condition allows symlink redirection

Published Sep 4, 2026 · Updated Nov 6, 2026 · Assigned by redhat

Description

A flaw was found in Flatpak. A Time-of-check to time-of-use (TOCTOU) race condition exists in the `org.freedesktop.Flatpak.SystemHelper` component. This vulnerability occurs because a privileged `chmod` operation executes before the OSTree repository validation within the `Deploy()` function. An attacker can exploit this timing window to redirect symlinks to arbitrary files, potentially leading to unauthorized file manipulation or information disclosure.

Affected products

VendorProductAffectedFixed
Red Hat Red Hat Enterprise Linux 10 — —
Red Hat Red Hat Enterprise Linux 7 — —
Red Hat Red Hat Enterprise Linux 8 — —
Red Hat Red Hat Enterprise Linux 9 — —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Ubuntu 26.10 flatpak No fix yet —
Ubuntu 26.04 LTS flatpak No fix yet —
Show 4 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 24.04 LTS flatpak No fix yet —
Ubuntu Pro 22.04 LTS flatpak No fix yet —
Ubuntu Pro 20.04 LTS flatpak No fix yet —
Ubuntu Pro 18.04 LTS flatpak No fix yet —

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 flatpak +5 1.18.1-1.amzn2023 ALAS2023-2026-3143

Advisories 1

References