CVE-2026-76925: Time-of-check Time-of-use (TOCTOU) Race Condition in Red Hat Red Hat Enterprise Linux 10

This vulnerability is a TOCTOU race condition in Flatpak's SystemHelper component on Red Hat Enterprise Linux 10. Specifically, a privileged chmod operation is performed before the OSTree repository validation within the Deploy() function. An attacker can exploit the timing gap to redirect symbolic links to arbitrary files, which may lead to unauthorized file manipulation or information disclosure. The CVSS 3.1 base score is 5.8, reflecting medium severity with local attack vector, high attack complexity, low privileges required, no user interaction, and impacts confidentiality, integrity, and availability.

Successful exploitation could allow a local attacker with limited privileges to manipulate files or disclose information by exploiting the race condition to redirect symlinks before validation occurs. This can compromise system integrity and confidentiality to some extent and may also affect availability.

The vendor advisory from Red Hat should be consulted for official remediation guidance. Patch status is not yet confirmed from the provided data; therefore, check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-76925 for current patch or mitigation information.