CVE-2026-97029: Flatpak Sandbox Escape DOS Vulnerability

CVE-2026-97029 Overview

CVE-2026-97029 is a sandbox escape weakness in Flatpak, the Linux application distribution and sandboxing framework. Flatpak's process ID (PID) namespace separation fails to prevent a sandboxed application from delivering signals to processes outside the sandbox that share the same process group. A sandboxed app can invoke kill(0, signal) or killpg(0, signal) to signal every process in its process group, including host processes such as the desktop shell. The flaw is classified under [CWE-653: Improper Isolation or Compartmentalization].

Critical Impact
A malicious or compromised Flatpak application can terminate host processes, including the user's desktop shell, causing denial of service on the host session.

Affected Products

Flatpak (sandboxing framework for Linux desktop applications)
Red Hat distributions shipping affected Flatpak builds
Any Linux desktop environment that launches Flatpak apps within a shared process group

Discovery Timeline

2026-09-29 - CVE CVE-2026-97029 published to the National Vulnerability Database (NVD)
2026-09-29 - Last updated in NVD database

Technical Details for CVE-2026-97029

Vulnerability Analysis

Flatpak relies on Linux PID namespaces to isolate a sandboxed application from host processes. Inside a PID namespace, processes cannot see or address arbitrary host PIDs. However, PID namespaces do not fully isolate process groups when the sandboxed process shares a process group ID (PGID) with the launching host process.

The POSIX signal APIs kill(0, signal) and killpg(0, signal) deliver the specified signal to every process in the caller's process group rather than to a specific PID. Because the kernel resolves these calls by PGID rather than by namespace-scoped PID lookup, signals cross the namespace boundary and reach host processes sharing the group.

The practical outcome is a denial of service. A hostile Flatpak app can send SIGTERM or SIGKILL to the desktop shell or other user-session processes, ending the graphical session and disrupting user workflows.

Root Cause

The root cause is incomplete compartmentalization between the Flatpak sandbox and the host. PID namespaces isolate identifier visibility but do not rewrite the process group relationships established when the sandboxed process was forked from a host parent. Signal delivery via kill(0, ...) and killpg(0, ...) bypasses PID-based checks and follows the shared PGID out of the namespace.

Attack Vector

Exploitation requires the attacker to control code running inside a Flatpak sandbox, either through a malicious app or a compromised legitimate app. The attacker issues a single signal syscall targeting the current process group. No elevated privileges inside the sandbox are required, and user interaction is limited to installing or running the affected Flatpak application. Confidentiality and integrity are not affected; availability of host processes is.

Refer to the GitHub Flatpak Security Advisory and the Red Hat CVE-2026-97029 advisory for authoritative technical details.

Detection Methods for CVE-2026-97029

Indicators of Compromise

Unexpected termination of the desktop shell (for example GNOME Shell, KDE Plasma) or other user-session processes while a Flatpak app is running.
Audit records showing kill or tgkill syscalls originating from a bwrap-hosted process targeting PID 0 (process group).
Repeated crashes or restarts of session services correlated with the launch of a specific Flatpak application.

Detection Strategies

Enable Linux audit rules for kill, tkill, and tgkill syscalls and filter for callers running inside Flatpak's bwrap sandbox namespaces.
Correlate signal delivery events with process group membership to identify signals that cross the sandbox boundary.
Baseline expected signal behavior per Flatpak application and alert on deviations.

Monitoring Recommendations

Monitor session manager logs (systemd --user, gnome-session, plasmashell) for abnormal shutdowns coinciding with Flatpak process activity.
Ingest audit and journal logs into a centralized analytics platform to correlate sandboxed process activity with host process termination.
Track installed Flatpak apps and their signatures to identify newly introduced or modified applications that warrant scrutiny.

How to Mitigate CVE-2026-97029

Immediate Actions Required

Apply Flatpak updates from your Linux distribution as soon as fixed packages are published; consult the Red Hat advisory and the Flatpak security advisory.
Inventory installed Flatpak applications and remove untrusted or unmaintained apps.
Restrict Flatpak installations to vetted sources such as Flathub verified publishers and organizational repositories.

Patch Information

Refer to the GitHub Flatpak Security Advisory GHSA-f3p8-vr7v-gxf2 for fixed versions and to the Red Hat Bug Report #2542698 for distribution-specific update status. Upgrade to the fixed Flatpak release once available for your distribution.

Workarounds

Launch Flatpak applications in a dedicated process group or session so they do not share a PGID with the desktop shell; wrappers such as setsid can create a new session and process group.
Avoid running the desktop shell in the same process group as Flatpak launchers; configure session startup scripts to isolate user shells.
Limit deployment of Flatpak applications from unverified publishers until fixed packages are installed.

bash

# Launch a Flatpak app in a new session and process group to prevent
# kill(0, ...) / killpg(0, ...) from reaching host processes.
setsid --fork flatpak run org.example.App