SB2026102437 - Fedora 43 update for flatpak
Published: October 24, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 2 vulnerabilities.
1) Link following (CVE-ID: CVE-2026-96807)
CWE-ID: CWE-59 - Improper Link Resolution Before File Access ('Link Following')
CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to write files with fixed names and fixed content outside of the sandbox.
The vulnerability exists due to improper link resolution in regenerate_ld_cache when handling a symlinked ~/.var/app/$appid/.ld.so path. A local user can replace ~/.var/app/$appid/.ld.so with a symlink to write files with fixed names and fixed content outside of the sandbox.
The filenames and file content are not attacker-controlled, which makes exploitation difficult.
2) Path traversal (CVE-ID: CVE-2026-96808)
CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to escalate privileges.
The vulnerability exists due to path traversal in the revokefs writer when processing repository data from unprivileged callers via symlink traversal between revokefs sessions. A local user can create a symlink between two revokefs sessions and retain a file descriptor to tamper with validated commit data to escalate privileges.
Exploitation requires an active local session and access to operations permitted by the system helper.
Remediation
Install update from vendor's website.