Red Hat Product Errata RHSA-2026:98490 - Security Advisory
Issued:
2026-11-11
Updated:
2026-11-11

RHSA-2026:98490 - Security Advisory

Synopsis

Important: flatpak security update

Type/Severity

Security Advisory: Important

Red Hat Lightspeed patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update for flatpak is now available for Red Hat Enterprise Linux 9.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.

Security Fix(es):

  • flatpak: Flatpak: Arbitrary code execution via missing symlink protection (CVE-2026-90616)
  • flatpak: flatpak: Arbitrary write access as root via extra-data extraction (CVE-2026-96275)
  • flatpak: flatpak: Buffer overflow in OCI delta stream path names on 32-bit systems (CVE-2026-96280)
  • flatpak: Flatpak: Local privilege escalation via symlink traversal in revokefs writer (CVE-2026-96808)
  • flatpak: flatpak: Arbitrary file deletion in root context via path traversal in deploy directory export/bin (CVE-2026-97023)
  • flatpak: flatpak: Arbitrary write in root context via path traversal in deploy directory files/etc (CVE-2026-97024)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • Red Hat Enterprise Linux for x86_64 9 x86_64
  • Red Hat Enterprise Linux for IBM z Systems 9 s390x
  • Red Hat Enterprise Linux for Power, little endian 9 ppc64le
  • Red Hat Enterprise Linux for ARM 64 9 aarch64
  • Red Hat CodeReady Linux Builder for x86_64 9 x86_64
  • Red Hat CodeReady Linux Builder for Power, little endian 9 ppc64le
  • Red Hat CodeReady Linux Builder for ARM 64 9 aarch64
  • Red Hat CodeReady Linux Builder for IBM z Systems 9 s390x

Fixes

  • BZ - 2532613 - CVE-2026-90616 flatpak: Flatpak: Arbitrary code execution via missing symlink protection
  • BZ - 2539416 - CVE-2026-96275 flatpak: flatpak: Arbitrary write access as root via extra-data extraction
  • BZ - 2539419 - CVE-2026-96280 flatpak: flatpak: Buffer overflow in OCI delta stream path names on 32-bit systems
  • BZ - 2539569 - CVE-2026-96808 flatpak: Flatpak: Local privilege escalation via symlink traversal in revokefs writer
  • BZ - 2542625 - CVE-2026-97024 flatpak: flatpak: Arbitrary write in root context via path traversal in deploy directory files/etc

Red Hat Enterprise Linux for x86_64 9

SRPM
flatpak-1.12.9-6.el9_9.5.src.rpm SHA-256: a3eab52150e5846172ff30416caac52a647b3d6238e3196b3768acfba28e9482
x86_64
flatpak-1.12.9-6.el9_9.5.x86_64.rpm SHA-256: 6731900bc6a39adb18a71d5250baab92405d2d76ef862c65d6b823e3dae975fb
flatpak-debuginfo-1.12.9-6.el9_9.5.i686.rpm SHA-256: 972289aa0f5063b2adafd35d6089653385f9e06e5ad6e2268ba75e166a0c07c5
flatpak-debuginfo-1.12.9-6.el9_9.5.x86_64.rpm SHA-256: 59f695771e57e274e960520bd0fecb19d9279411f48cb3eca68d2b5747290ade
flatpak-debugsource-1.12.9-6.el9_9.5.i686.rpm SHA-256: d91318fc55a1e27ac5a33e1a9b34401647cdd0307160dbf350f8f242c80ce8bc
flatpak-debugsource-1.12.9-6.el9_9.5.x86_64.rpm SHA-256: 9ee057e3359c7a0c6fe4d961867601f52f0c5a06777d9a8453364dc4649c1da0
flatpak-libs-1.12.9-6.el9_9.5.i686.rpm SHA-256: a1b8c67610858254e420e8d7661cf97be11bdf441675f69b9eca3ebf88668c05
flatpak-libs-1.12.9-6.el9_9.5.x86_64.rpm SHA-256: a14ef3dbac48b3d8efc7b2efde4c690909c8d372f326c494e787b1ea3c9d68f3
flatpak-libs-debuginfo-1.12.9-6.el9_9.5.i686.rpm SHA-256: 2c4013b7b4032aee5160d0a4f013cf72cd96ed9b744218caf7edc47a863674d7
flatpak-libs-debuginfo-1.12.9-6.el9_9.5.x86_64.rpm SHA-256: 68c07de6ca948777219464ee7994679a10b4114982f5893d43804e41bc4608d2
flatpak-selinux-1.12.9-6.el9_9.5.noarch.rpm SHA-256: fa8704c05d482cc5307607edb06b2199772caf589ca5b284a942031df19de5f1
flatpak-session-helper-1.12.9-6.el9_9.5.x86_64.rpm SHA-256: b3ba7e9d0ee79f01df2f8676e339ef9c9eba37054cfed960f1c33b5bef4f3f9c
flatpak-session-helper-debuginfo-1.12.9-6.el9_9.5.i686.rpm SHA-256: a7b3fbdadce6f7ddc5cfd47e50b1478a3852d893145b9b467197f9aeb1b5e819
flatpak-session-helper-debuginfo-1.12.9-6.el9_9.5.x86_64.rpm SHA-256: 2c7cee69b9385b9e547fe6663deb433d4e0292f22bb5194c182dac13dcf38eda
flatpak-tests-debuginfo-1.12.9-6.el9_9.5.i686.rpm SHA-256: d0956223d9d16eb5a77b6c455fb530ed7ae775583371712beea13c19806f0144
flatpak-tests-debuginfo-1.12.9-6.el9_9.5.x86_64.rpm SHA-256: 587fbf01fb04966ec340185e13baf74b2752fb7af2f4282ac4448ec0968caf54

Red Hat Enterprise Linux for IBM z Systems 9

SRPM
flatpak-1.12.9-6.el9_9.5.src.rpm SHA-256: a3eab52150e5846172ff30416caac52a647b3d6238e3196b3768acfba28e9482
s390x
flatpak-1.12.9-6.el9_9.5.s390x.rpm SHA-256: bf829449fd70ef21a3ee0d7b884de64c3937a465721b6432c17c290875a8183a
flatpak-debuginfo-1.12.9-6.el9_9.5.s390x.rpm SHA-256: 46fe3f40ddaddaf105da1e804110058c794579c4446dc9ad6fce08fa37c505fe
flatpak-debugsource-1.12.9-6.el9_9.5.s390x.rpm SHA-256: 4e9e196e3996593c27df4f5780fd6e4c4980935af204f83d935e757a4fa1778f
flatpak-libs-1.12.9-6.el9_9.5.s390x.rpm SHA-256: d7d79f8348889c98d9b2dee4580d38ac5df2172b5f8bceadc45d2816e40f1535
flatpak-libs-debuginfo-1.12.9-6.el9_9.5.s390x.rpm SHA-256: ff6b66bf3b29ae004a7b63a60cf42b35d69e0dc88b621f759db49cf85ca95d03
flatpak-selinux-1.12.9-6.el9_9.5.noarch.rpm SHA-256: fa8704c05d482cc5307607edb06b2199772caf589ca5b284a942031df19de5f1
flatpak-session-helper-1.12.9-6.el9_9.5.s390x.rpm SHA-256: 04e6bf0e97595fe970fdbc172c29b982534b3945aeee4667464a3856f0ebb6a4
flatpak-session-helper-debuginfo-1.12.9-6.el9_9.5.s390x.rpm SHA-256: b30c978a4b1f2b887113b02e59bc09821eafce94ade608cd320c8707ae9f7509
flatpak-tests-debuginfo-1.12.9-6.el9_9.5.s390x.rpm SHA-256: edc0c24f26eca82169b805441aa12b22e09cc87c50151b2238f283d72570d30a

Red Hat Enterprise Linux for Power, little endian 9

SRPM
flatpak-1.12.9-6.el9_9.5.src.rpm SHA-256: a3eab52150e5846172ff30416caac52a647b3d6238e3196b3768acfba28e9482
ppc64le
flatpak-1.12.9-6.el9_9.5.ppc64le.rpm SHA-256: 8b6c144712877d231d555b87464570dca3f422d940d290dfec54bc0414fbf197
flatpak-debuginfo-1.12.9-6.el9_9.5.ppc64le.rpm SHA-256: 1d29d92ebbbbb7cc6977a199249502805ee6ed5d1b219f96ef3e9d385d62c609
flatpak-debugsource-1.12.9-6.el9_9.5.ppc64le.rpm SHA-256: f1f071a028ce08d1272c09663bd265f52bc85e873678e7a53746e146a002e7e7
flatpak-libs-1.12.9-6.el9_9.5.ppc64le.rpm SHA-256: 1e5a3a2ab59790a0bd5fc14389053e5947876f86158e1d58207c7007f133fb5c
flatpak-libs-debuginfo-1.12.9-6.el9_9.5.ppc64le.rpm SHA-256: ffdd1c95affc1fe6464234f1141afbbe3a35afa864deb3524887797bd87b6ffd
flatpak-selinux-1.12.9-6.el9_9.5.noarch.rpm SHA-256: fa8704c05d482cc5307607edb06b2199772caf589ca5b284a942031df19de5f1
flatpak-session-helper-1.12.9-6.el9_9.5.ppc64le.rpm SHA-256: 798c7c6886516d1ebfd86275c69776348952186708690276281939275f36fafa
flatpak-session-helper-debuginfo-1.12.9-6.el9_9.5.ppc64le.rpm SHA-256: ac28c320817be5cb9ac9c30dfcfe2fcdb56ec6f16a71a4890f70efa9d5f18571
flatpak-tests-debuginfo-1.12.9-6.el9_9.5.ppc64le.rpm SHA-256: c34a144922ea5d735038fd374ec4c51f9b4c95e7e854dbd4155d90152f5af0ee

Red Hat Enterprise Linux for ARM 64 9

SRPM
flatpak-1.12.9-6.el9_9.5.src.rpm SHA-256: a3eab52150e5846172ff30416caac52a647b3d6238e3196b3768acfba28e9482
aarch64
flatpak-1.12.9-6.el9_9.5.aarch64.rpm SHA-256: 96b8e25c5456841aa7dd587b07009339e5da9dc778e3472416a9bb289d941e3d
flatpak-debuginfo-1.12.9-6.el9_9.5.aarch64.rpm SHA-256: 3c88596f85881d5fd72b8cdb96735376dfe4ae7ae6a6dbd6463aad6bc3513371
flatpak-debugsource-1.12.9-6.el9_9.5.aarch64.rpm SHA-256: eafc66033efddcf7217c60891eb4984bae5865f8edb4f8500946ede65da1fa37
flatpak-libs-1.12.9-6.el9_9.5.aarch64.rpm SHA-256: 71c8b918c517137476147e7ef2ff0b1c1240279d20fd71596c1de35802717b52
flatpak-libs-debuginfo-1.12.9-6.el9_9.5.aarch64.rpm SHA-256: ce5c17e9848e1ca04493e8d6c280ef00ccd561a9f75124ac72c8e7bf49c67817
flatpak-selinux-1.12.9-6.el9_9.5.noarch.rpm SHA-256: fa8704c05d482cc5307607edb06b2199772caf589ca5b284a942031df19de5f1
flatpak-session-helper-1.12.9-6.el9_9.5.aarch64.rpm SHA-256: ca4d979e24ef48c9186071c371d4da780fff06374337984601e2be2a5c2fef4c
flatpak-session-helper-debuginfo-1.12.9-6.el9_9.5.aarch64.rpm SHA-256: 2e670ba182daf822b4b023751098f1d80830a0bcd90972d5a04830b7b1a872c8
flatpak-tests-debuginfo-1.12.9-6.el9_9.5.aarch64.rpm SHA-256: d075d5231608525075fe584ae7539b0114ec89b71f57f13097a5035aa5e6e0c1

Red Hat CodeReady Linux Builder for x86_64 9

SRPM
x86_64
flatpak-1.12.9-6.el9_9.5.i686.rpm SHA-256: 54c75003ff97f70e1d8507e7d36cc40621e7140e2583e466404f155120ad8137
flatpak-debuginfo-1.12.9-6.el9_9.5.i686.rpm SHA-256: 972289aa0f5063b2adafd35d6089653385f9e06e5ad6e2268ba75e166a0c07c5
flatpak-debuginfo-1.12.9-6.el9_9.5.x86_64.rpm SHA-256: 59f695771e57e274e960520bd0fecb19d9279411f48cb3eca68d2b5747290ade
flatpak-debugsource-1.12.9-6.el9_9.5.i686.rpm SHA-256: d91318fc55a1e27ac5a33e1a9b34401647cdd0307160dbf350f8f242c80ce8bc
flatpak-debugsource-1.12.9-6.el9_9.5.x86_64.rpm SHA-256: 9ee057e3359c7a0c6fe4d961867601f52f0c5a06777d9a8453364dc4649c1da0
flatpak-devel-1.12.9-6.el9_9.5.i686.rpm SHA-256: 05a5634d9618ccf1da1f3229e7d3c8ebebb3ed62d0f255d348d2c84aed62b46e
flatpak-devel-1.12.9-6.el9_9.5.x86_64.rpm SHA-256: edd19728c06d4ff12551a13c5ecab3771126cdb7f5b2893c51e5ae8ebfb00a11
flatpak-libs-debuginfo-1.12.9-6.el9_9.5.i686.rpm SHA-256: 2c4013b7b4032aee5160d0a4f013cf72cd96ed9b744218caf7edc47a863674d7
flatpak-libs-debuginfo-1.12.9-6.el9_9.5.x86_64.rpm SHA-256: 68c07de6ca948777219464ee7994679a10b4114982f5893d43804e41bc4608d2
flatpak-session-helper-1.12.9-6.el9_9.5.i686.rpm SHA-256: d4d5e0c1f487a64b288920686e99dc5ff5491045681f54c648ff5a18498f2ec4
flatpak-session-helper-debuginfo-1.12.9-6.el9_9.5.i686.rpm SHA-256: a7b3fbdadce6f7ddc5cfd47e50b1478a3852d893145b9b467197f9aeb1b5e819
flatpak-session-helper-debuginfo-1.12.9-6.el9_9.5.x86_64.rpm SHA-256: 2c7cee69b9385b9e547fe6663deb433d4e0292f22bb5194c182dac13dcf38eda
flatpak-tests-debuginfo-1.12.9-6.el9_9.5.i686.rpm SHA-256: d0956223d9d16eb5a77b6c455fb530ed7ae775583371712beea13c19806f0144
flatpak-tests-debuginfo-1.12.9-6.el9_9.5.x86_64.rpm SHA-256: 587fbf01fb04966ec340185e13baf74b2752fb7af2f4282ac4448ec0968caf54

Red Hat CodeReady Linux Builder for Power, little endian 9

SRPM
ppc64le
flatpak-debuginfo-1.12.9-6.el9_9.5.ppc64le.rpm SHA-256: 1d29d92ebbbbb7cc6977a199249502805ee6ed5d1b219f96ef3e9d385d62c609
flatpak-debugsource-1.12.9-6.el9_9.5.ppc64le.rpm SHA-256: f1f071a028ce08d1272c09663bd265f52bc85e873678e7a53746e146a002e7e7
flatpak-devel-1.12.9-6.el9_9.5.ppc64le.rpm SHA-256: 98dff1059170a441b7f28f80eddbdf5794adf68e605e755a261bc245c66e231b
flatpak-libs-debuginfo-1.12.9-6.el9_9.5.ppc64le.rpm SHA-256: ffdd1c95affc1fe6464234f1141afbbe3a35afa864deb3524887797bd87b6ffd
flatpak-session-helper-debuginfo-1.12.9-6.el9_9.5.ppc64le.rpm SHA-256: ac28c320817be5cb9ac9c30dfcfe2fcdb56ec6f16a71a4890f70efa9d5f18571
flatpak-tests-debuginfo-1.12.9-6.el9_9.5.ppc64le.rpm SHA-256: c34a144922ea5d735038fd374ec4c51f9b4c95e7e854dbd4155d90152f5af0ee

Red Hat CodeReady Linux Builder for ARM 64 9

SRPM
aarch64
flatpak-debuginfo-1.12.9-6.el9_9.5.aarch64.rpm SHA-256: 3c88596f85881d5fd72b8cdb96735376dfe4ae7ae6a6dbd6463aad6bc3513371
flatpak-debugsource-1.12.9-6.el9_9.5.aarch64.rpm SHA-256: eafc66033efddcf7217c60891eb4984bae5865f8edb4f8500946ede65da1fa37
flatpak-devel-1.12.9-6.el9_9.5.aarch64.rpm SHA-256: 608f427ef468a8bd7af90ae06ea4b64c8eb197e5da300f1745889ba67a8b53e9
flatpak-libs-debuginfo-1.12.9-6.el9_9.5.aarch64.rpm SHA-256: ce5c17e9848e1ca04493e8d6c280ef00ccd561a9f75124ac72c8e7bf49c67817
flatpak-session-helper-debuginfo-1.12.9-6.el9_9.5.aarch64.rpm SHA-256: 2e670ba182daf822b4b023751098f1d80830a0bcd90972d5a04830b7b1a872c8
flatpak-tests-debuginfo-1.12.9-6.el9_9.5.aarch64.rpm SHA-256: d075d5231608525075fe584ae7539b0114ec89b71f57f13097a5035aa5e6e0c1

Red Hat CodeReady Linux Builder for IBM z Systems 9

SRPM
s390x
flatpak-debuginfo-1.12.9-6.el9_9.5.s390x.rpm SHA-256: 46fe3f40ddaddaf105da1e804110058c794579c4446dc9ad6fce08fa37c505fe
flatpak-debugsource-1.12.9-6.el9_9.5.s390x.rpm SHA-256: 4e9e196e3996593c27df4f5780fd6e4c4980935af204f83d935e757a4fa1778f
flatpak-devel-1.12.9-6.el9_9.5.s390x.rpm SHA-256: e077b0342613bec018204100ef2718e6c12103286a5dd010aea0f39cb98fb458
flatpak-libs-debuginfo-1.12.9-6.el9_9.5.s390x.rpm SHA-256: ff6b66bf3b29ae004a7b63a60cf42b35d69e0dc88b621f759db49cf85ca95d03
flatpak-session-helper-debuginfo-1.12.9-6.el9_9.5.s390x.rpm SHA-256: b30c978a4b1f2b887113b02e59bc09821eafce94ade608cd320c8707ae9f7509
flatpak-tests-debuginfo-1.12.9-6.el9_9.5.s390x.rpm SHA-256: edc0c24f26eca82169b805441aa12b22e09cc87c50151b2238f283d72570d30a

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.