ALAS2023-2026-3143

References: CVE-2026-76925  CVE-2026-90616  CVE-2026-96275  CVE-2026-96808 
FAQs regarding Amazon Linux ALAS/CVE Severity

Issue Overview:

A flaw was found in Flatpak. A Time-of-check to time-of-use (TOCTOU) race condition exists in the `org.freedesktop.Flatpak.SystemHelper` component. This vulnerability occurs because a privileged `chmod` operation executes before the OSTree repository validation within the `Deploy()` function. An attacker can exploit this timing window to redirect symlinks to arbitrary files, potentially leading to unauthorized file manipulation or information disclosure. (CVE-2026-76925)

In Flatpak before 1.18.1, a malicious sandboxed app can obtain arbitrary read and write access to files on the host, which can be escalated to arbitrary code execution on the host, a different vulnerability than CVE-2026-76925. Flatpak creates a few app data directories (e.g., /var/cache, /var/data, /var/config, and /var/tmp) in every sandbox on every app launch where, in some cases, components of the path are attacker-controlled. Missing symlink protection can redirect the directories. Some of these directories are bind-mounted by Flatpak by passing the path (e.g., /home/user/.var/app/APP_ID/cache/tmp), which contains attacker-controlled directories (tmp) to bwrap --bind SRC DST. bwrap passes the path on to the kernel, which then follows symlinks. A malicious symlink can point to arbitrary locations on the host and it will become mounted inside the sandbox. (CVE-2026-90616)

A malicious or compromised Flatpak repository can write attacker-controlled content to arbitrary locations on the host filesystem via extract_extra_data(). On system installs, the write happens as root. Two issues combine: `files/extra` is resolved via path operations that follow symlinks, and blob names from `xa.extra-data-sources` are not sanitized against `..` traversal. (CVE-2026-96275)

In Flatpak before 1.18.1, the revokefs writer, used by the flatpak-system-helper to receive repository data from unprivileged callers, validated file paths by rejecting literal .. components but did not prevent symlink traversal. A malicious local user in an active local session could obtain two revokefs sessions via the system helper, create a symlink in one session pointing into the other session's directory, and retain a file descriptor through that symlink. This allowed the attacker to modify files belonging to a different revokefs session after they had been validated and imported by the system helper. In particular, an attacker could use this to tamper with ostree commit objects in the system repository after they passed signature verification, enabling root-controlled file writes to attacker-chosen paths and local root privilege escalation. (CVE-2026-96808)

Issue Correction:
Run dnf update flatpak --releasever 2023.12.20260928 or dnf update --advisory ALAS2023-2026-3143 --releasever 2023.12.20260928 to update your system.
More information on how to update your system can be found on this page: Amazon Linux 2023 documentation

New Packages:

aarch64:
    flatpak-debuginfo-1.18.1-1.amzn2023.aarch64
    flatpak-libs-debuginfo-1.18.1-1.amzn2023.aarch64
    flatpak-session-helper-1.18.1-1.amzn2023.aarch64
    flatpak-devel-1.18.1-1.amzn2023.aarch64
    flatpak-session-helper-debuginfo-1.18.1-1.amzn2023.aarch64
    flatpak-libs-1.18.1-1.amzn2023.aarch64
    flatpak-tests-1.18.1-1.amzn2023.aarch64
    flatpak-1.18.1-1.amzn2023.aarch64
    flatpak-tests-debuginfo-1.18.1-1.amzn2023.aarch64
    flatpak-debugsource-1.18.1-1.amzn2023.aarch64

noarch:
    flatpak-selinux-1.18.1-1.amzn2023.noarch

src:
    flatpak-1.18.1-1.amzn2023.src

x86_64:
    flatpak-debuginfo-1.18.1-1.amzn2023.x86_64
    flatpak-libs-debuginfo-1.18.1-1.amzn2023.x86_64
    flatpak-session-helper-debuginfo-1.18.1-1.amzn2023.x86_64
    flatpak-debugsource-1.18.1-1.amzn2023.x86_64
    flatpak-devel-1.18.1-1.amzn2023.x86_64
    flatpak-session-helper-1.18.1-1.amzn2023.x86_64
    flatpak-1.18.1-1.amzn2023.x86_64
    flatpak-tests-debuginfo-1.18.1-1.amzn2023.x86_64
    flatpak-libs-1.18.1-1.amzn2023.x86_64
    flatpak-tests-1.18.1-1.amzn2023.x86_64

Changelog:

2026-09-30: CVE-2026-96275 was added to this advisory.

2026-09-30: CVE-2026-96808 was added to this advisory.