CVE-2026-76925

A flaw was found in Flatpak. A Time-of-check to time-of-use (TOCTOU) race condition exists in the org.freedesktop.Flatpak.SystemHelper component. This vulnerability occurs because a privileged chmod operation executes before the OSTree repository validation within the Deploy() function. An attacker can exploit this timing window to redirect symlinks to arbitrary files, potentially leading to unauthorized file manipulation or information disclosure.

A flaw of Moderate impact was found in Flatpak's org.freedesktop.Flatpak.SystemHelper service, which is used by Red Hat Enterprise Linux and Red Hat In-Vehicle OS. A Time-of-Check to Time-of-Use (TOCTOU) race condition exists in the Deploy() function, where a privileged chmod operation is performed before the OSTree repository is validated. A local attacker with limited privileges who wins this timing race can redirect symlinks so that the privileged operation targets arbitrary files, potentially resulting in unauthorized file manipulation or information disclosure. Successful exploitation requires local access and winning a narrow race window (CVSS 3.1 score 5.8, AV:L/AC:H/PR:L), which matches the upstream severity assessment. The flatpak packages in Red Hat Enterprise Linux and Red Hat In-Vehicle OS are affected and the fix is currently deferred; the residual risk is limited because exploitation requires a local attacker with prior account access to successfully win the race. For Fedora, this issue was delegated to the community and resolved as not affected (NOTABUG).

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.