CVE-2026-97029
Flatpak: flatpak: sandboxed app can signal unsandboxed processes in the same process group
Flatpak's process ID namespace separation does not prevent a sandboxed app's kill(0, signal) or killpg(0, signal) calls from reaching processes outside the sandbox that share the same process group. A malicious or compromised Flatpak app can use this to cause denial of service by terminating processes outside its sandbox, such as the desktop shell.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Flatpak: flatpak: sandboxed app can signal unsandboxed processes in the same process group
Flatpak's process ID namespace separation does not prevent a sandboxed app's kill(0, signal) or killpg(0, signal) calls from reaching processes outside the sandbox that share the same process group. A malicious or compromised Flatpak app can use this to cause denial of service by terminating processes outside its sandbox, such as the desktop shell.
- Record
CVE-2026-97029- CVSS 3.1
- 5.7 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-653
- Updated
- 2026-11-06
EUVDEUVD-2026-88627
Flatpak's process ID namespace separation does not prevent a sandboxed app's kill(0, signal) or killpg(0, signal) calls from reaching processes outside the sandbox that share the same process group. A malicious or compromised Flatpak app can use this to cause denial of service by terminating processes outside its sandbox, such as the desktop shell.
- Record
EUVD-2026-88627- CVSS 3.1
- 5.7 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-06
NVD
Flatpak's process ID namespace separation does not prevent a sandboxed app's kill(0, signal) or killpg(0, signal) calls from reaching processes outside the sandbox that share the same process group. A malicious or compromised Flatpak app can use this to cause denial of service by terminating processes outside its sandbox, such as the desktop shell.
- Record
CVE-2026-97029- CVSS 3.1
- 5.7 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-653
- Updated
- 2026-11-06
OSVDEBIAN-CVE-2026-97029
Flatpak's process ID namespace separation does not prevent a sandboxed app's kill(0, signal) or killpg(0, signal) calls from reaching processes outside the sandbox that share the same process group. A malicious or compromised Flatpak app can use this to cause denial of service by terminating processes outside its sandbox, such as the desktop shell.
- Record
DEBIAN-CVE-2026-97029- CVSS 3.1
- 5.7 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-97029
Flatpak's process ID namespace separation does not prevent a sandboxed app's kill(0, signal) or killpg(0, signal) calls from reaching processes outside the sandbox that share the same process group. A malicious or compromised Flatpak app can use this to cause denial of service by terminating processes outside its sandbox, such as the desktop shell.
- Record
UBUNTU-CVE-2026-97029- CVSS 3.1
- 5.7 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVMGASA-2026-0477 No score
Updated flatpak package fixes security vulnerabilities
Arbitrary file deletion in root context via path traversal in deploy directory export/bin. (CVE-2026-97023) Arbitrary write in root context via path traversal in deploy directory files/etc. (CVE-2026-97024) World-readable oci authentication token in system-helper cache path. (CVE-2026-97025) World-writable temporary child repositories in system-helper cache path. (CVE-2026-97026) Denial of service via unsanitized keys in exported desktop entry / d-bus service files. (CVE-2026-97027) Sandboxed app can signal unsandboxed processes in the same process group. (CVE-2026-97029)
- Record
MGASA-2026-0477- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:11918-1 No score
flatpak-1.18.4-1.1 on GA media
These are all security issues fixed in the flatpak-1.18.4-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:11918-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
flatpakDebian:12 |
All versions, plus listed versions 1.14.10-11.14.10-1~deb12u11.14.10-1~deb12u21.14.4-11.14.4-1+deb12u1 Show 45 moreShow less1.14.4-1+deb12u1~bpo11+11.14.4-21.14.5-11.14.6-11.14.6-1~deb13u11.14.8-11.14.8-1~deb12u11.15.0-11.15.0-21.15.1-11.15.10-11.15.12-11.15.2-11.15.3-11.15.4-11.15.6-11.15.7-11.15.8-11.15.9-11.15.91-11.16.0-11.16.0-21.16.0-2~bpo12+11.16.1-11.16.1-1~bpo12+11.16.1-21.16.1-31.16.2-11.16.2-1~deb13u11.16.3-11.16.3-1~deb13u11.16.4-11.16.4-21.16.5-11.16.6-11.16.6-1~deb13u11.16.6-1~deb13u1~bpo12+11.16.6-1~deb13u21.16.6-1~deb13u31.17.2-11.17.3-11.17.3-21.17.6-11.18.0-11.18.1-1 |
None known |
flatpakDebian:13 |
before 1.16.6-1~deb13u3, plus listed versions 1.16.1-11.16.1-21.16.1-31.16.2-11.16.2-1~deb13u1 Show 8 moreShow less1.16.3-11.16.3-1~deb13u11.16.4-11.16.4-21.16.5-11.16.6-1~deb13u11.16.6-1~deb13u1~bpo12+11.16.6-1~deb13u2 |
1.16.6-1~deb13u3 |
flatpakDebian:14 |
before 1.18.4-1, plus listed versions 1.16.1-11.16.1-21.16.1-31.16.2-11.16.2-1~deb13u1 Show 18 moreShow less1.16.3-11.16.3-1~deb13u11.16.4-11.16.4-21.16.5-11.16.6-11.16.6-1~deb13u11.16.6-1~deb13u1~bpo12+11.16.6-1~deb13u21.16.6-1~deb13u31.17.2-11.17.3-11.17.3-21.17.6-11.18.0-11.18.1-11.18.2-11.18.3-1 |
1.18.4-1 |
flatpakMageia:10 From an advisory covering 6 CVEs |
before 1.16.6-1.2.mga10 | 1.16.6-1.2.mga10 |
flatpakUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 0.8.7-50.10.0-10.10.0-20.10.1-10.10.2-1 Show 16 moreShow less0.10.2.1-10.10.2.1-20.10.3-10.11.1-0ubuntu10.11.3-20.11.3-30.11.7-0ubuntu0.11.0.1-0ubuntu0.11.0.6-0ubuntu0.11.0.7-0ubuntu0.18.04.11.0.8-0ubuntu0.18.04.11.0.9-0ubuntu0.11.0.9-0ubuntu0.21.0.9-0ubuntu0.31.0.9-0ubuntu0.41.0.9-0ubuntu0.4+esm1 |
None known |
flatpakUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 1.4.3-11.6.0-11.6.1-11.6.2-11.6.3-1 Show 6 moreShow less1.6.5-0ubuntu0.11.6.5-0ubuntu0.21.6.5-0ubuntu0.31.6.5-0ubuntu0.41.6.5-0ubuntu0.51.6.5-0ubuntu0.5+esm1 |
None known |
flatpakUbuntu:Pro:22.04:LTS |
All versions, plus listed versions 1.10.2-31.12.2-11.12.2-21.12.3-11.12.4-1 Show 5 moreShow less1.12.5-11.12.6-11.12.7-11.12.7-1ubuntu0.11.12.7-1ubuntu0.1+esm1 |
None known |
flatpakUbuntu:Pro:24.04:LTS |
All versions, plus listed versions 1.14.4-21.14.5-11.14.5-1build11.14.5-1build41.14.5-1build5 Show 4 moreShow less1.14.5-1build61.14.6-11.14.6-1ubuntu0.11.14.6-1ubuntu0.1+esm1 |
None known |
flatpakUbuntu:26.10 |
All versions, plus listed versions 1.16.6-11.18.0-11.18.1-11.18.2-11.18.4-1 |
None known |
flatpakUbuntu:26.04:LTS |
All versions, plus listed versions 1.16.1-2ubuntu11.16.1-3ubuntu11.16.2-11.16.3-11.16.3-1build11.16.4-11.16.4-21.16.6-1 |
None known |
flatpakopenSUSE:Tumbleweed From an advisory covering 6 CVEs |
before 1.18.4-1.1 | 1.18.4-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | CVE List, NVD | |
| facts | EUVD | |
| first indexed | CVE List, EUVD, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-97029 is a medium vulnerability (CVSS 5.7) in Red Hat Enterprise Linux 10, published September 29, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.24%, the 15th percentile. Fixed in flatpak 1.16.6-1~deb13u3.
References
access.redhat.com/security/cve/CVE-2026-97029
bugzilla.redhat.com/show_bug.cgi?id=2542698
github.com/flatpak/flatpak/security/advisories/GHSA-f3p8-vr7v-gxf2
security-tracker.debian.org/tracker/CVE-2026-97029
advisories.mageia.org/MGASA-2026-0477.html
bugs.mageia.org/show_bug.cgi?id=36401
Show 15 moreShow less
openwall.com/lists/oss-security/2026/09/28/6
lists.debian.org/debian-security-announce/2026/msg00437.html
ubuntu.com/security/CVE-2026-97029
cve.org/CVERecord?id=CVE-2026-97029
suse.com/security/cve/CVE-2026-97023
Left out here: 3 versions. The JSON record has them.