Sandbox Bypass Vulnerability in Flatpak Affecting Red Hat
CVE-2026-97029
5.7MEDIUM
What is CVE-2026-97029?
The Flatpak application framework faces a significant vulnerability where its process ID namespace separation fails to adequately contain sandboxed applications. Specifically, an exploited app could execute kill(0, signal) or killpg(0, signal) calls. This could result in denial of service, where processes outside the sandbox, such as the desktop shell, could be terminated unexpectedly. This flaw presents serious implications for system stability and security, as a compromised Flatpak application can bypass the intended isolation, affecting the overall user environment.
References
CVSS V3.1
Score:
5.7
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved
Credit
Red Hat would like to thank Guthrie Armstrong (Coalition Inc.) for reporting this issue.