fix: CVE-2026-10294 - Do not accept symlinks as frontend socket

debian/changelog

@@ -1,3 +1,12 @@
+packagekit (1.2.8-2deepin3) unstable; urgency=medium
+
+  * Fix CVE-2026-10294: Do not accept symlinks as frontend socket to
+    prevent unauthorized file probing via SetHints frontend-socket
+    argument
+
+ -- deepin-ci-robot <packages@deepin.org>  Thu, 18 Jun 2026 03:18:35 +0800
+
+
 packagekit (1.2.8-2deepin2) unstable; urgency=medium
 
   * Do not allow re-invoking methods on non-new transactions

debian/patches/CVE-2026-10294.patch

@@ -0,0 +1,52 @@
+Description: Do not accept symlinks as frontend socket
+ If a debconf frontend socket is passed, we now ensure that it isn't a
+ symlink and is a socket, instead of following it and revealing that the
+ symlinked file exists (CVE-2026-10294).
+Author: Corentin Noël <corentin.noel@collabora.com>
+Origin: upstream, https://github.com/PackageKit/PackageKit/commit/4c1994d0545dea8a66cc56d9457ff740965abaf0
+Bug: https://github.com/PackageKit/PackageKit/issues/969
+Last-Update: 2026-06-18
+
+--- a/src/pk-transaction.c
++++ b/src/pk-transaction.c
+@@ -4797,6 +4797,7 @@ pk_transaction_set_hint (PkTransaction *transaction,
+
+ 	/* frontend_socket=/tmp/socket.3456 */
+ 	if (g_strcmp0 (key, "frontend-socket") == 0) {
++		GStatBuf st;
+
+ 		/* nothing provided */
+ 		if (value == NULL || value[0] == '\0') {
+@@ -4816,14 +4817,24 @@ pk_transaction_set_hint (PkTransaction *transaction,
+ 			return FALSE;
+ 		}
+
+-		/* socket does not exist */
+-		if (!g_file_test (value, G_FILE_TEST_EXISTS)) {
+-			g_set_error_literal (error,
+-					     PK_TRANSACTION_ERROR,
+-					     PK_TRANSACTION_ERROR_NOT_SUPPORTED,
+-					     "frontend-socket does not exist");
+-			return FALSE;
+-		}
++		/* must be an actual socket and must not be a symlink:
++		 * lstat() doesn't follow symlinks (which would let callers
++		 * probe arbitrary paths as root), and allows us to reject
++		 * anything that is not a Unix socket */
++		if (g_lstat (value, &st) != 0) {
++			g_set_error_literal (error,
++					     PK_TRANSACTION_ERROR,
++					     PK_TRANSACTION_ERROR_NO_SUCH_FILE,
++					     "frontend-socket does not exist");
++			return FALSE;
++		}
++		if (!S_ISSOCK (st.st_mode)) {
++			g_set_error_literal (error,
++					     PK_TRANSACTION_ERROR,
++					     PK_TRANSACTION_ERROR_INPUT_INVALID,
++					     "frontend-socket is not a socket");
++			return FALSE;
++		}
+
+ 		/* success */
+ 		pk_backend_job_set_frontend_socket (priv->job, value);

debian/patches/series

@@ -3,3 +3,6 @@ policy.diff
 02_identify-ubuntu.patch
 03_not_call_dbus_on_ostree_booted_systems.patch
 PK_Do-not-allow-re-invoking-methods-on-non-new-txn.patch
+
+# CVE-2026-10294
+CVE-2026-10294.patch