CVE-2026-97029

Vendor solution

Run Flatpak apps in a new session (setsid flatpak run ... or setsid() in the parent) or a new process group (setpgid (0, 0) in the parent), or avoid running untrusted Flatpak apps.

Red Hat statement

Red Hat estimates the CVSSv3.1 vector of CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H from the upstream CVSSv4.0 vector CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N (score 5.1). Exploitation requires a victim to install and run a malicious or compromised Flatpak app (UI:R), after which the process-group signal leak is triggered automatically with no additional attacker privileges or access complexity beyond that of a normal sandboxed app (AV:N, AC:L, PR:L). No subsequent system beyond the local host is affected, so scope is unchanged (S:U). There is no confidentiality or integrity impact (C:N, I:N). The availability impact is scored for the reasonable worst case described in the upstream advisory: under common desktop configurations (e.g. GNOME Shell), a malicious app can terminate the desktop shell itself, ending the user's entire session (A:H).

Red Hat mitigation

Run Flatpak apps in a new session (setsid flatpak run ... or setsid() in the parent) or a new process group (setpgid (0, 0) in the parent), or avoid running untrusted Flatpak apps.