CVE-2026-97029

MediumCVSS 5.7/10Last modified Sep 29, 2026

Description

Flatpak's process ID namespace separation does not prevent a sandboxed app's kill(0, signal) or killpg(0, signal) calls from reaching processes outside the sandbox that share the same process group. A malicious or compromised Flatpak app can use this to cause denial of service by terminating processes outside its sandbox, such as the desktop shell.

Metrics

CVSS 3.1 5.7/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-653

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Sep 29, 2026
Last modified: Sep 29, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-97037.1Grafana's data source proxy did not apply role-based access control to write requests forwarded to Loki data sources. A user holding only th CVE-2026-970306.1A trusted template author may have previously written a valid template wherein the use of the 'yield' keyword would not be correctly escaped CVE-2026-970317.5Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted packet that could t CVE-2026-970327.5HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies CVE-2026-97048.8A flaw was found in Keycloak. An authenticated user with low privileges can exploit this vulnerability by sending an oversized subject_token CVE-2026-97056.5A flaw was found in Keycloak's client registration service. A remote attacker, possessing a previously issued Registration Access Token (RAT CVE-2026-970558.1SigNoz from v0.8.0 before v0.143.0 defaults the JWT tokenizer signing secret (tokenizer::jwt::secret, set via SIGNOZ_TOKENIZER_JWT_SECRET or CVE-2026-970566.8SigNoz versions from v0.98.0 up to (but not including) v0.143.0, when configured to use the opaque session tokenizer (which was not the defa CVE-2026-970577.5redis-parser through 3.0.0 fails to validate the multi-bulk length value in RESP protocol parsing, allowing attackers to trigger an uncaught CVE-2026-970598.2DCMTK through 3.7.0 contains a heap over-read vulnerability in ConcatenationLoader that copies pixel data frames without validating the Pixe CVE-2026-970607.2X-SpringBoot through 6.0 lacks object-level authorization in user management endpoints, allowing sub-administrators to modify or delete user CVE-2026-970614.3Black Candy through 3.2.1 fails to scope playlist search queries to the authenticated session user, allowing any authenticated user to enume