(A flaw was found in Flatpak. A Time-of-check to time-of-use (TOCTOU) r ...) (CVE-2026-76925)

CVE-2026-76925 is a TOCTOU race condition vulnerability in Flatpak's org.freedesktop.Flatpak.SystemHelper component. The issue arises because a privileged chmod operation executes before the OSTree repository validation in the Deploy() function. This timing gap allows an attacker to redirect symlinks to arbitrary files, which may result in unauthorized file manipulation or information disclosure. The vulnerability is classified under CWE-367 (Time-of-check Time-of-use Race Condition) and has a CVSS v3.1 score of 5.8 (medium severity) with local attack vector, high attack complexity, low privileges required, no user interaction, unchanged scope, high confidentiality impact, low integrity impact, and low availability impact. According to the Red Hat advisory, the vulnerability affects Flatpak components but does not specify affected versions or confirm patch availability.

The vulnerability allows an attacker with local access and low privileges to exploit a race condition to redirect symbolic links to arbitrary files during a privileged chmod operation. This can lead to unauthorized file manipulation or information disclosure, impacting confidentiality significantly, with lesser impacts on integrity and availability. The flaw may also allow hiding of malicious activities due to potential log file manipulation. However, exploitation requires high attack complexity and local access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The Red Hat advisory indicates the issue is under investigation or fix may be forthcoming. Until a fix is released, no specific mitigation is provided. Users should monitor official vendor advisories for updates and apply patches once available.