Red Hat Ships Important Flatpak Fix for Privilege Escalation Code Execution and Buffer Overflow Flaws
Red Hat has published security advisory RHSA-2026:80498, an Important-rated update for the flatpak package on Red Hat Enterprise Linux 10, issued and updated on 12 October 2026. Flatpak is the framework used to build, distribute and run sandboxed desktop applications on Linux, which means the flaws sit directly on the boundary that is supposed to separate untrusted application content from the host operating system. Four CVEs are addressed in this release: CVE-2026-90616, arbitrary code execution caused by missing symlink protection; CVE-2026-96275, arbitrary write access as root during extra-data extraction; CVE-2026-96280, a buffer overflow in OCI delta stream path names on 32-bit systems; and CVE-2026-96808, local privilege escalation through symlink traversal in the revokefs writer. The fixed build is flatpak-1.16.0-9.el10_2.4, covering the main flatpak package along with flatpak-libs, flatpak-selinux and flatpak-session-helper. Affected products span Red Hat Enterprise Linux 10 and the 10.2 Extended Update Support, four-year update and Extended Life Cycle streams on x86_64, aarch64, ppc64le and s390x, as well as the matching CodeReady Linux Builder channels.
Red Hat's advisory names the vulnerability classes but does not publish a step-by-step exploitation chain, directing readers to the individual CVE pages for impact detail and CVSS scoring, so no attack sequence should be assumed beyond what the vendor states. What the summaries do make clear is that three of the four issues involve filesystem handling in privileged code paths. Two of them, CVE-2026-90616 and CVE-2026-96808, involve symlinks being followed where they should not be, with the revokefs writer issue described as yielding local privilege escalation. CVE-2026-96275 concerns the extraction of extra-data content, a step Flatpak performs when an application pulls additional files outside the normal OSTree repository flow, and is described as permitting arbitrary write access as root. CVE-2026-96280 is a memory-safety defect, a buffer overflow in the handling of path names carried in OCI delta streams, which is exercised when delta content is processed during application downloads. Collectively, these are local rather than remote problems, with the realistic entry point being the installation or update of an application from a remote that the user does not fully control.
The strategic weight of this advisory comes from where Flatpak sits in the stack rather than from any observed attack. Flatpak runs with elevated helper components, and a flaw that turns application content into root-level file writes undermines the core assumption that a sandboxed app cannot touch the host. On developer workstations, build servers and CodeReady Linux Builder systems, that boundary is often the only thing standing between third-party application bundles and the underlying operating system, which places this squarely in the supply chain risk category for any team that installs Flatpak applications from community remotes. On current exploitation status, the evidence is limited and should be read plainly: FIRST EPSS places the probability of exploitation in the next 30 days at 0.2 percent for CVE-2026-90616, 0.4 percent for CVE-2026-96275, 0.6 percent for CVE-2026-96280 and 0.1 percent for CVE-2026-96808. None of the four is recorded as being exploited in the wild, and no public exploit activity is described in the advisory. The practical exposure is therefore a patching and inventory question across a broad set of RHEL 10 variants rather than an active incident, though the number of lifecycle streams affected means large estates are likely to find vulnerable hosts in more than one channel.
Attack Surface
Endpoint OS, Server OS, Supply Chain (Third-party vendors)
Tactics
Privilege Escalation, Execution, Defense Evasion
Techniques
- T1068 – Exploitation for Privilege Escalation
- T1548 – Abuse Elevation Control Mechanism
- T1574 – Hijack Execution Flow
- T1611 – Escape to Host
SuperPRO's Threat Countermeasures Procedures
- Update flatpak and its subpackages to 1.16.0-9.el10_2.4 or later on all Red Hat Enterprise Linux 10 and 10.2 hosts using 'dnf update flatpak flatpak-libs flatpak-session-helper flatpak-selinux', which carries the fixes for CVE-2026-90616, CVE-2026-96275, CVE-2026-96280 and CVE-2026-96808.
- Confirm remediation per host with 'rpm -q flatpak flatpak-libs flatpak-session-helper flatpak-selinux' and treat any build earlier than 1.16.0-9.el10_2.4 as unpatched, including CodeReady Linux Builder systems on x86_64, aarch64, ppc64le and s390x.
- Use Red Hat Lightspeed patch analysis, referenced in RHSA-2026:80498, to enumerate subscribed systems flagged against this errata across the RHEL 10, 10.2 EUS, four-year-update and Extended Life Cycle channels before scheduling the maintenance window.
- Ensure each affected host is subscribed to the channel matching its lifecycle stream listed in RHSA-2026:80498 – Red Hat Enterprise Linux 10, 10.2 Extended Update Support, the four-year update stream or Extended Life Cycle – so that dnf offers the flatpak-1.16.0-9.el10_2.4 errata on that system.
- Apply the errata using the procedure Red Hat references in RHSA-2026:80498 for installing package updates, which covers the flatpak, flatpak-libs, flatpak-selinux and flatpak-session-helper binary packages shipped in this release.
- Apply the same errata on CodeReady Linux Builder systems, which RHSA-2026:80498 lists as a separately shipped channel, so builder hosts do not remain on a flatpak build earlier than 1.16.0-9.el10_2.4 after the AppStream repositories have been updated.
- Use the individual Red Hat CVE pages for CVE-2026-90616, CVE-2026-96275, CVE-2026-96280 and CVE-2026-96808, which RHSA-2026:80498 points to for impact detail and CVSS scoring, to rank which of the x86_64, aarch64, ppc64le and s390x hosts take the update first.
