CVE-2026-97029— Flatpak: flatpak: sandboxed app can signal unsandboxed processes in the same process group

Quick assessment

Copy summary Copy citation

Affected

Red Hat Red Hat Enterprise Linux 10

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Flatpak's process ID namespace separation does not prevent a sandboxed app's kill(0, signal) or killpg(0, signal) calls from reaching processes outside the sandbox that share the same process group. A malicious or compromised Flatpak app can use this to cause

CVE-2026-97029 affects Red Hat Red Hat Enterprise Linux 10. No confirmed in-the-wild exploitation; assess based on exposure. Flatpak's process ID namespace separation does not prevent a sandboxed app's kill(0, signal) or killpg(0, signal) calls from reaching processes outside the sandbox that share the s CVE-2026-97029 vulnerability details, Shenlong CVE Platform, https://cve.imfht.com/detail/CVE-2026-97029

I. Basic Information for CVE-2026-97029

Affected Products

II. Public POCs for CVE-2026-97029

III. Intelligence Information for CVE-2026-97029

Other References for CVE-2026-97029 (3)

• https://github.com/flatpak/flatpak/security/advisories/GHSA-f3p8-vr7v-gxf2
• https://access.redhat.com/security/cve/CVE-2026-97029 vdb-entry x_refsource_REDHAT
• https://bugzilla.redhat.com/show_bug.cgi?id=2542698 issue-tracking x_refsource_REDHAT

• https://www.cve.org/CVERecord?id=CVE-2026-97029

IV. Related Vulnerabilities

V. Comments for CVE-2026-97029