CLSA-2026-1790035964

See a problem?
Import Source
https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1790035964.json
JSON Data
https://api.osv.dev/v1/vulns/CLSA-2026-1790035964
Upstream
Published
2026-09-22T00:12:54Z
Modified
2026-10-26T09:30:49Z
Summary
flatpak: Fix of CVE-2026-90616
Details
  • CVE-2026-90616: flatpak_ensure_data_dir and flatpak_run_setup_base_argv resolved the app data subdirectories by path, so an app could replace them with symlinks between runs and have them followed during the next sandbox setup; both now resolve them with glnx_chase_and_mkdirat()/glnx_chaseat() confined beneath the app data directory
  • Update the bundled libglnx with the glnx_chaseat API the above fix needs
  • Carry the upstream regression test for the above fix
References

Affected packages

TuxCare:AlmaLinux:9.6
flatpak

Package

Name
flatpak
Purl
pkg:rpm/tuxcare/flatpak?distro=almalinux-9.6

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.12.9-4.el9_6.tuxcare.els3

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1790035964.json"
flatpak-devel

Package

Name
flatpak-devel
Purl
pkg:rpm/tuxcare/flatpak-devel?distro=almalinux-9.6

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.12.9-4.el9_6.tuxcare.els3

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1790035964.json"
flatpak-libs

Package

Name
flatpak-libs
Purl
pkg:rpm/tuxcare/flatpak-libs?distro=almalinux-9.6

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.12.9-4.el9_6.tuxcare.els3

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1790035964.json"
flatpak-selinux

Package

Name
flatpak-selinux
Purl
pkg:rpm/tuxcare/flatpak-selinux?distro=almalinux-9.6

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.12.9-4.el9_6.tuxcare.els3

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1790035964.json"
flatpak-session-helper

Package

Name
flatpak-session-helper
Purl
pkg:rpm/tuxcare/flatpak-session-helper?distro=almalinux-9.6

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.12.9-4.el9_6.tuxcare.els3

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1790035964.json"
flatpak-tests

Package

Name
flatpak-tests
Purl
pkg:rpm/tuxcare/flatpak-tests?distro=almalinux-9.6

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.12.9-4.el9_6.tuxcare.els3

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1790035964.json"