Vulnerability feed

Executive summary

Red Hat advisory RHSA-2026:89850 provides a security update for flatpak, the Linux system for running sandboxed desktop applications, on Red Hat Enterprise Linux 9. The advisory rates the update Important and says two flaws allow arbitrary file deletion and arbitrary writes in root context. Red Hat recommends applying the update, which the advisory points to through a Red Hat knowledge base article.

Technical summary

The two flaws are path traversal issues in flatpak deploy directories: CVE-2026-97023 allows arbitrary file deletion in root context via export/bin, and CVE-2026-97024 allows arbitrary write in root context via files/etc. The advisory does not state the attack vector, required privileges or preconditions, or a CVSS score; it refers readers to the CVE pages for those details. The fixed package version is flatpak-1.12.9-4.el9_8.6, and the advisory does not state any affected (vulnerable) version range. No workarounds are stated, and the advisory gives no detection guidance or information on exploitation in the wild.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from access.redhat.com/errata/RHSA-2026:89850

Impact if exploited

How it is exploited

Attack vector

Network

Attack complexity

Low

Privileges required

None

User interaction

Required

Scope

Unchanged

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H

Affects

Red HatflatpakRed Hat Enterprise LinuxflatpakRed Hat Enterprise Linux for x86_64 9Red Hat Enterprise Linux for IBM z Systems 9Red Hat Enterprise Linux for Power, little endian 9Red Hat Enterprise Linux for ARM 64 9Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.8Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 9.8Red Hat Enterprise Linux for Power, little endian - Extended Update Support 9.8Red Hat Enterprise Linux for ARM 64 - Extended Update Support 9.8Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.8Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.8Red Hat CodeReady Linux Builder for x86_64 9Red Hat CodeReady Linux Builder for Power, little endian 9Red Hat CodeReady Linux Builder for ARM 64 9Red Hat CodeReady Linux Builder for IBM z Systems 9Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support 9.8Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support 9.8Red Hat CodeReady Linux Builder for IBM z Systems - Extended Update Support 9.8Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support 9.8Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.8Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.8Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 9.8Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 9.8Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 9.8Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 9.8