ELSA-2026-80498

ELSA-2026-80498 - flatpak security update

Type:	SECURITY
Impact:	IMPORTANT
Release Date:	2026-10-11

Description

[1.16.0-9.4]
- Avoid symlink path traversal in revokefs writer (CVE-2026-96808)
Resolves: RHEL-267891
- Prevent arbitrary write as root via extra-data extraction (CVE-2026-96275)
Resolves: RHEL-267432
- Use gsize for OCI delta sizes and harden delta parser (CVE-2026-96280)
Resolves: RHEL-271519

[1.16.0-9.3]
- Align backport with the other branches
Resolves: RHEL-258970

[1.16.0-9.2]
- Harden data dir and var setup against symlink attacks
Resolves: RHEL-258970

Related CVEs

CVE-2026-90616

CVE-2026-96275

CVE-2026-96280

CVE-2026-96808

Updated Packages

Release/Architecture	Filename	sha256	Superseded By Advisory	Channel Label
Oracle Linux 10 (aarch64)	flatpak-1.16.0-9.el10_2.4.src.rpm	8958e2b45895d0a371521f84947508ce20021fddb6bbfa9252cd32477a1fba6a	-	ol10_aarch64_appstream
	flatpak-1.16.0-9.el10_2.4.src.rpm	8958e2b45895d0a371521f84947508ce20021fddb6bbfa9252cd32477a1fba6a	-	ol10_aarch64_codeready_builder
	flatpak-1.16.0-9.el10_2.4.aarch64.rpm	4f70fcb9e299ccfaa1789fe2c6bfe8dc289b6740d5017247a2c2d10c1907716e	-	ol10_aarch64_appstream
	flatpak-devel-1.16.0-9.el10_2.4.aarch64.rpm	5bd74675bd83cdc5d3904f28ab24d5a1270e9256baf1c80e50407eb7bc5870f1	-	ol10_aarch64_codeready_builder
	flatpak-libs-1.16.0-9.el10_2.4.aarch64.rpm	3c483aac2756f623f00e88f90faf9e4891a736128ab8420d80918394517a0a56	-	ol10_aarch64_appstream
	flatpak-selinux-1.16.0-9.el10_2.4.noarch.rpm	d71dbb5808540bcccdc03457717e14dec275e5c866044691c239474b72bfbe96	-	ol10_aarch64_appstream
	flatpak-session-helper-1.16.0-9.el10_2.4.aarch64.rpm	28537550b9e1ad764c9698ed328e894a4fc49dc0907c38e409d0d702a3e9d08c	-	ol10_aarch64_appstream
Oracle Linux 10 (x86_64)	flatpak-1.16.0-9.el10_2.4.src.rpm	8958e2b45895d0a371521f84947508ce20021fddb6bbfa9252cd32477a1fba6a	-	ol10_x86_64_appstream
	flatpak-1.16.0-9.el10_2.4.src.rpm	8958e2b45895d0a371521f84947508ce20021fddb6bbfa9252cd32477a1fba6a	-	ol10_x86_64_codeready_builder
	flatpak-1.16.0-9.el10_2.4.x86_64.rpm	fcb08d432148cead18fc2b08b8bc4c6bf65f5b96ab19fd7e1b22400dadfa3adf	-	ol10_x86_64_appstream
	flatpak-devel-1.16.0-9.el10_2.4.x86_64.rpm	926e16f6e11849395bb6cb4278d1cc261ec882021be43f9bcc6162f584779c17	-	ol10_x86_64_codeready_builder
	flatpak-libs-1.16.0-9.el10_2.4.x86_64.rpm	c97b88e86da859b76c1c42662bdfc680f830f3d1d07cb21f3058be084bfad44a	-	ol10_x86_64_appstream
	flatpak-selinux-1.16.0-9.el10_2.4.noarch.rpm	d71dbb5808540bcccdc03457717e14dec275e5c866044691c239474b72bfbe96	-	ol10_x86_64_appstream
	flatpak-session-helper-1.16.0-9.el10_2.4.x86_64.rpm	65404fe834a2caad05b74b31ff70673863179a9f2603b8450aa461c322ccaaaf	-	ol10_x86_64_appstream

This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections please contact the Oracle Linux ULN team