CVE-2026-76925: Time-of-check Time-of-use (TOCTOU) Race Condition in Red Hat Red Hat Enterprise Linux 10

This vulnerability is a TOCTOU race condition in Flatpak's SystemHelper component where a privileged chmod operation is executed before the OSTree repository validation within the Deploy() function. This timing window can be exploited by an attacker to redirect symbolic links to arbitrary files, potentially enabling unauthorized file manipulation or information disclosure. The issue affects Red Hat Enterprise Linux 10 as shipped with Flatpak. The CVSS 3.1 vector is AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:L, indicating local attack with high complexity and low privileges required, resulting in high confidentiality impact and low integrity and availability impacts. Red Hat is the authoritative source for this vulnerability and provides a vendor advisory at https://access.redhat.com/security/cve/CVE-2026-76925.

An attacker with local access and low privileges can exploit this race condition to redirect symlinks to arbitrary files, potentially leading to unauthorized disclosure of sensitive information and limited unauthorized modification of files. The vulnerability does not require user interaction and affects confidentiality primarily, with some impact on integrity and availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-76925 for current remediation guidance. Red Hat's advisory indicates the issue is under investigation or fix may be forthcoming. Until a fix is released, users should monitor the advisory and consider applying any recommended mitigations or workarounds provided by Red Hat. Customers with Red Hat Technical Account Managers can consult them for tailored advice.