CVE-2026-76925 Flatpak: flatpak: toctou race condition allows symlink redirection
A TOCTOU race condition in Flatpak's system helper allows attackers to redirect symlinks, leading to unauthorized file manipulation or information disclosure.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-76925?
CVE-2026-76925 is a medium-severity vulnerability in Red Hat Enterprise Linux 10, published on 4 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A flaw was found in Flatpak. A Time-of-check to time-of-use (TOCTOU) race condition exists in the `org.freedesktop.Flatpak.SystemHelper` component. This vulnerability occurs because a privileged `chmod` operation executes before the OSTree repository validation within the `Deploy()` function. An attacker can exploit this timing window to redirect symlinks to arbitrary files, potentially leading to unauthorized file manipulation or information disclosure.
Weakness: CWE-367
Which versions are affected by CVE-2026-76925?
How do I fix CVE-2026-76925?
No fix has been published for CVE-2026-76925 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-76925 being exploited?
There is no known exploitation of CVE-2026-76925 in the wild and no public exploit code.
Sources
Also known as GHSA-639f-3fwc-hmpx, UBUNTU-CVE-2026-76925.