Public bug reported:
After upgrading bubblewrap from 0.9.0-1ubuntu0.1 to 0.9.0-1ubuntu0.2
(security update for CVE-2026-87766), flatpak applications that
attempt to access the CUPS printing socket fail to start with:
bwrap: Can't resolve /var/run/cups/cups.sock: Too many levels of
symbolic links
System info:
- Linux Mint 22.3 (based on Ubuntu Noble)
- bubblewrap 0.9.0-1ubuntu0.2
- flatpak 1.14.6
The host filesystem is not broken. /var/run is a standard symlink to
/run:
$ ls -la /var/run/cups/
srw-rw-rw- 1 root root 0 wrz 17 20:46 cups.sock
$ readlink -f /var/run/cups/cups.sock
/run/cups/cups.sock
$ systemctl status cups
Active: active (running)
Manual resolution of the path works fine outside the sandbox. The
cups.sock file itself is a valid socket, not a broken or looping
symlink.
Reverting to bubblewrap 0.9.0-1ubuntu0.1 immediately fixes the issue,
confirming the regression was introduced by the CVE-2026-87766 patch
(debian/patches/CVE-2026-87766-2.patch: "Create and resolve
destinations without following symlinks, and reject mount operations
on symlink destinations").
It appears the fix now rejects any bind-mount whose destination path
passes through an intermediate symlink component — which includes
the legacy /var/run/* paths that flatpak still uses for CUPS (and
potentially other) socket exposure on any system where /var/run is a
symlink to /run (the standard usrmerge layout on Ubuntu/Debian-based
systems, including Linux Mint).
This likely affects every flatpak application on such a system that
uses CUPS printing, not just one specific app (reproduced with
eu.betterbird.Betterbird from Flathub).
Workaround: disabling the cups socket for flatpak apps avoids the
crash, at the cost of losing print support from within the sandbox:
sudo flatpak override --system --nosocket=cups
Steps to reproduce:
1. Have a system where /var/run is a symlink to /run (default on
Ubuntu/Mint).
2. Install any flatpak app from Flathub that requests CUPS access
(e.g. eu.betterbird.Betterbird).
3. Update bubblewrap to 0.9.0-1ubuntu0.2.
4. Run the app: flatpak run eu.betterbird.Betterbird
5. Observe the bwrap error and the app failing to launch.
Expected result: the app launches normally, with CUPS access
available as before.
Actual result: the app fails to launch entirely.
** Affects: bubblewrap (Ubuntu)
Importance: Undecided
Status: Confirmed
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2167639
Title:
bubblewrap 0.9.0-1ubuntu0.2 (CVE-2026-87766 fix) breaks flatpak access
to /var/run/cups/cups.sock when /var/run is a symlink to /run
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/bubblewrap/+bug/2167639/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
