Red Hat Product Errata RHSA-2026:99010 - Security Advisory
Issued:
2026-11-11
Updated:
2026-11-11

RHSA-2026:99010 - Security Advisory

Synopsis

Important: flatpak security update

Type/Severity

Security Advisory: Important

Red Hat Lightspeed patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update for flatpak is now available for Red Hat Enterprise Linux 7 Extended Lifecycle Support.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.

Security Fix(es):

  • flatpak: Flatpak: Arbitrary code execution via missing symlink protection (CVE-2026-90616)
  • flatpak: flatpak: Arbitrary write access as root via extra-data extraction (CVE-2026-96275)
  • flatpak: flatpak: Buffer overflow in OCI delta stream path names on 32-bit systems (CVE-2026-96280)
  • flatpak: Flatpak: Local privilege escalation via symlink traversal in revokefs writer (CVE-2026-96808)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • Red Hat Enterprise Linux Server - Extended Life Cycle Support 7 x86_64
  • Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 7 s390x
  • Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, big endian 7 ppc64
  • Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, little endian 7 ppc64le

Fixes

  • BZ - 2532613 - CVE-2026-90616 flatpak: Flatpak: Arbitrary code execution via missing symlink protection
  • BZ - 2539416 - CVE-2026-96275 flatpak: flatpak: Arbitrary write access as root via extra-data extraction
  • BZ - 2539419 - CVE-2026-96280 flatpak: flatpak: Buffer overflow in OCI delta stream path names on 32-bit systems
  • BZ - 2539569 - CVE-2026-96808 flatpak: Flatpak: Local privilege escalation via symlink traversal in revokefs writer

Red Hat Enterprise Linux Server - Extended Life Cycle Support 7

SRPM
flatpak-1.12.9-6.el7_9.src.rpm SHA-256: 9ffa8ed234fe245d9829263c30850e1067d68c2cf044aff4b94d11de8a5d3ffe
x86_64
flatpak-1.12.9-6.el7_9.x86_64.rpm SHA-256: 8b4ac0633f89c85fa93546419fa62e7165b61d3efd65f60c9f5d1e21834c0b5e
flatpak-builder-1.0.0-18.el7_9.x86_64.rpm SHA-256: 768a852da8abfa3a6ea00649368014971214fa1aab8e5cecd285d33aee61861d
flatpak-debuginfo-1.12.9-6.el7_9.x86_64.rpm SHA-256: f762835a38bed9ea60a1c37fd0d0064619b604238bfdb2ff1cbffa4cc4310db8
flatpak-debuginfo-1.12.9-6.el7_9.x86_64.rpm SHA-256: f762835a38bed9ea60a1c37fd0d0064619b604238bfdb2ff1cbffa4cc4310db8
flatpak-devel-1.12.9-6.el7_9.x86_64.rpm SHA-256: 51be51c2ac6720f7f4c56feb761fa87c0c5ff807e950e6cfb2e438744e8f7756
flatpak-libs-1.12.9-6.el7_9.x86_64.rpm SHA-256: f0f917665b1153e342b999aae298b0411aa6194df5554138670876f36e727dcd

Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 7

SRPM
flatpak-1.12.9-6.el7_9.src.rpm SHA-256: 9ffa8ed234fe245d9829263c30850e1067d68c2cf044aff4b94d11de8a5d3ffe
s390x
flatpak-1.12.9-6.el7_9.s390x.rpm SHA-256: 1b88fdcd7b798c0ac4206f22b58cb799d62ededc7aa9fcce4fd3228ee186df3f
flatpak-builder-1.0.0-18.el7_9.s390x.rpm SHA-256: 81c4d484eb8611aec0818a01ee2526ba0d82ce968a7e32d8e4e33a132c32a4c9
flatpak-debuginfo-1.12.9-6.el7_9.s390x.rpm SHA-256: 086fc61674224674659369dc2b6e09440066f41cfaa75f73816129518be52b61
flatpak-debuginfo-1.12.9-6.el7_9.s390x.rpm SHA-256: 086fc61674224674659369dc2b6e09440066f41cfaa75f73816129518be52b61
flatpak-devel-1.12.9-6.el7_9.s390x.rpm SHA-256: 430efab9194a164aabc19d17c9f62e9bc5f73703564e6ffbdd41c53ee002335a
flatpak-libs-1.12.9-6.el7_9.s390x.rpm SHA-256: 42a1340b3bc6bfe7755b7a20fcfbe44e8d332307a431ebaec2f5f6537d61f092

Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, big endian 7

SRPM
flatpak-1.12.9-6.el7_9.src.rpm SHA-256: 9ffa8ed234fe245d9829263c30850e1067d68c2cf044aff4b94d11de8a5d3ffe
ppc64
flatpak-1.12.9-6.el7_9.ppc64.rpm SHA-256: 16c5e0bdd578c1f250e427d6ecf34f819fedf7761c6cba6cc91dcf68afdeef55
flatpak-builder-1.0.0-18.el7_9.ppc64.rpm SHA-256: 8d97bebfc6ae547b6a4894ac768a0ba1f60b46b9d3da12fd08c89c840015b39e
flatpak-debuginfo-1.12.9-6.el7_9.ppc64.rpm SHA-256: 70f6da1a0d926daad4318fe5f4859d6a57bb0c006c5371ad5d0498e9739229df
flatpak-debuginfo-1.12.9-6.el7_9.ppc64.rpm SHA-256: 70f6da1a0d926daad4318fe5f4859d6a57bb0c006c5371ad5d0498e9739229df
flatpak-devel-1.12.9-6.el7_9.ppc64.rpm SHA-256: ad8f3ca692473cae2cbd40660c6c3bd315d4e5bc6b9ccd4c2cd3a2dad4e22884
flatpak-libs-1.12.9-6.el7_9.ppc64.rpm SHA-256: f3d410e8ff22bb8f844a4b014d0b578d7b074c579b0080174d0eabb3a35d8110

Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, little endian 7

SRPM
flatpak-1.12.9-6.el7_9.src.rpm SHA-256: 9ffa8ed234fe245d9829263c30850e1067d68c2cf044aff4b94d11de8a5d3ffe
ppc64le
flatpak-1.12.9-6.el7_9.ppc64le.rpm SHA-256: b2c04ce7f069de645a61a55a4d70b6e026448595546a9e6ff3a3af706ace1628
flatpak-builder-1.0.0-18.el7_9.ppc64le.rpm SHA-256: 913669cac00a847dac82b88aa479b3c85522fc78d434c3421a33ac1ca0a6a86f
flatpak-debuginfo-1.12.9-6.el7_9.ppc64le.rpm SHA-256: 152b1b390cc403e42bb5e67b9b3f183e4c6f60d31513f97a987919435934222b
flatpak-debuginfo-1.12.9-6.el7_9.ppc64le.rpm SHA-256: 152b1b390cc403e42bb5e67b9b3f183e4c6f60d31513f97a987919435934222b
flatpak-devel-1.12.9-6.el7_9.ppc64le.rpm SHA-256: 322d73cf8c1f9c0e242d841c1ca7e4fed4cade43b82108861aac913cd239e0f7
flatpak-libs-1.12.9-6.el7_9.ppc64le.rpm SHA-256: 3fae52c8059b3ff1e258bc8e8ac52e61c3dac7be4d323c8710dc0c8fa421a117

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.