CVE-2026-97029
MEDIUM
MEDIUM
Priority: 0.01
BB Relevance:
51/100
Published: 2026-09-29
Modified: 2026-11-06
First seen: 2026-11-06
Status: active
Attack Surface
Network
Low Complexity
CVSS Vector Breakdown
AV:
Network
AC:
Low
PR:
Low
UI:
Required
S:
Unchanged
C:
None
I:
None
A:
High
Description
Flatpak's process ID namespace separation does not prevent a sandboxed app's kill(0, signal) or killpg(0, signal) calls from reaching processes outside the sandbox that share the same process group. A malicious or compromised Flatpak app can use this to cause denial of service by terminating processes outside its sandbox, such as the desktop shell.
Weakness Classification (1)
References & Advisories (3)
vdb-entry
x_refsource_REDHAT
issue-tracking
x_refsource_REDHAT