CVE-2026-92162

A flaw was found in Flatpak. This vulnerability can lead to local privilege escalation when combined with other flaws. On systems configured with an Open Container Initiative (OCI) remote repository, an active local user can supply a crafted architecture name to trick the system helper service into creating root-owned files and directories outside the intended directory.

Red Hat rates this vulnerability as Important because an unprivileged local user could leverage directory traversal in the system helper service to achieve full root privilege escalation. Exploitation strictly requires an active local user session alongside configured Open Container Initiative (OCI) remotes. In default Red Hat Enterprise Linux installations, OCI remotes are not enabled out of the box, substantially limiting overall exposure unless administrators have deliberately configured such repositories.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, systems can eliminate the conditions required for exploitation by removing OCI remotes or disabling the Flatpak system helper service:

1. Remove configured OCI remotes: Exploitation requires at least one OCI remote to be present. Inspect configured remotes using:

flatpak remote-list

If any OCI remotes are configured and not strictly required, remove them:

flatpak remote-delete <remote-name>

2. Alternatively, disable the Flatpak system helper daemon: If system-level Flatpak application management is not required, mask the helper service:

systemctl mask --now flatpak-system-helper.service

Caveats:

• Deleting an OCI remote prevents installing or refreshing applications from that repository.
• Masking flatpak-system-helper.service takes effect immediately, terminating the service and blocking system-wide Flatpak operations. User-level Flatpak operations executed with the '--user' flag remain operational. No system restart is required.