fix(cve): CVE-2026-10294 - daemon: Do not accept symlinks as frontend socket

debian/changelog

@@ -1,3 +1,9 @@
+packagekit (1.2.8-2deepin3) unstable; urgency=medium
+
+  * fix(cve): CVE-2026-10294
+
+ -- deepin-ci-robot <packages@deepin.org>  Thu, 16 Jul 2026 23:53:09 +0800
+
 packagekit (1.2.8-2deepin2) unstable; urgency=medium
 
   * Do not allow re-invoking methods on non-new transactions

debian/patches/CVE-2026-10294.patch

@@ -0,0 +1,46 @@
+Description: CVE-2026-10294 - 安全修复
+Author: Matthias Klumpp <matthias@tenstral.net>
+Origin: https://github.com/PackagePK/PackagePK/commit/4c1994d0545dea8a66cc56d9457ff740965abaf0
+Bug: https://nvd.nist.gov/vuln/detail/CVE-2026-10294
+Last-Update: 2026-06-16
+---
+
+diff --git a/src/pk-transaction.c b/src/pk-transaction.c
+index 2b760e3..28b46ee 100644
+--- a/src/pk-transaction.c
++++ b/src/pk-transaction.c
+@@ -4796,6 +4796,7 @@ pk_transaction_set_hint (PkTransaction *transaction,
+
+ 	/* frontend_socket=/tmp/socket.3456 */
+ 	if (g_strcmp0 (key, "frontend-socket") == 0) {
++		GStatBuf st;
+
+ 		/* nothing provided */
+ 		if (value == NULL || value[0] == '\0') {
+@@ -4815,14 +4816,24 @@ pk_transaction_set_hint (PkTransaction *transaction,
+ 			return FALSE;
+ 		}
+
+-		/* socket does not exist */
+-		if (!g_file_test (value, G_FILE_TEST_EXISTS)) {
++		/* must be an actual socket and must not be a symlink:
++		 * lstat() doesn't follow symlinks (which would let callers
++		 * probe arbitrary paths as root), and allows us to reject
++		 * anything that is not a Unix socket */
++		if (g_lstat (value, &st) != 0) {
+ 			g_set_error_literal (error,
+ 					     PK_TRANSACTION_ERROR,
+ 					     PK_TRANSACTION_ERROR_NOT_SUPPORTED,
+ 					     "frontend-socket does not exist");
+ 			return FALSE;
+ 		}
++		if (!S_ISSOCK (st.st_mode)) {
++			g_set_error_literal (error,
++					     PK_TRANSACTION_ERROR,
++					     PK_TRANSACTION_ERROR_NOT_SUPPORTED,
++					     "frontend-socket is not a socket");
++			return FALSE;
++		}
+
+ 		/* success */
+ 		pk_backend_job_set_frontend_socket (priv->job, value);

debian/patches/series

@@ -3,3 +3,4 @@ policy.diff
 02_identify-ubuntu.patch
 03_not_call_dbus_on_ostree_booted_systems.patch
 PK_Do-not-allow-re-invoking-methods-on-non-new-txn.patch
+CVE-2026-10294.patch