CVE-2026-76925

CVE-2026-76925 is a TOCTOU race condition in Flatpak's org.freedesktop.Flatpak.SystemHelper component. The root cause is that a privileged chmod operation executes before OSTree repository validation within the Deploy() function, creating a timing window an attacker can exploit to redirect symlin...