Public bug reported: `xdg-desktop-portal 1.18.4-1ubuntu2.24.04.2` — the Noble security update for CVE-2026-40354 / USN-8287-1 — breaks `org.freedesktop.portal.Trash` for Flatpak applications whose trash/delete-to-trash operations use the portal.
Reproduced directly with GNOME Loupe from Flathub on elementary OS 8.1 / Ubuntu 24.04.4. With `G_MESSAGES_DEBUG=all` enabled for `xdg-desktop- portal.service`: ``` Handling TrashFile Failed trashing file: Failed getting the parent fd ``` `gio trash` on the same file outside the sandbox succeeds. This isolates the failure to the portal path rather than the filesystem or Trash directory; `~/.local/share/Trash` is healthy and the filesystem is plain ext4. This matches the upstream regression exactly. In flatpak/xdg-desktop- portal#1972, Flatpak Nautilus fails after the CVE fix with the same: ``` Failed trashing file: Failed getting the parent fd ``` https://github.com/flatpak/xdg-desktop-portal/issues/1972 Possibly related: - Bazaar (Flatpak app store) — [bazaar-org/bazaar#1481](https://github.com/bazaar-org/bazaar/issues/1481), "Trash User Data doesn't work" - Warehouse (Flatpak data manager) — [flattool/warehouse#172](https://github.com/flattool/warehouse/issues/172), logs "Trash portal failed" removing leftover app data ## Root cause The CVE-2026-40354 fix was released upstream in xdg-desktop-portal 1.20.4 and 1.21.1. It replaced the vulnerable path-based `g_file_trash()` operation with fd-based resolution to prevent a symlink/TOCTOU attack. That change introduced a regression for Flatpak callers. Upstream fixed it in #1982 by correcting handling of the file descriptor when the caller is in a different mount namespace: https://github.com/flatpak/xdg-desktop-portal/pull/1982 #1982 merged on 2026-05-05 and was released in xdg-desktop-portal 1.21.2 on 2026-05-06, whose release notes state: > Fix a regression which broke trashing files in Flatpak (#1982). Ubuntu 24.04 tracks the older 1.18.x branch, so the CVE fix was backported to Noble as `1.18.4-1ubuntu2.24.04.2`. The Noble package changelog contains the CVE-2026-40354 backport, including the fd-based Trash implementation, but does not list the subsequent #1982 regression fix. The observed failure on Noble is the same failure reported upstream before #1982. Could the #1982 fix, or the equivalent host-mount-namespace fd handling, please be backported to the Ubuntu 24.04 package? As of 2026-09-05, `noble-updates` and `noble-security` still contain `1.18.4-1ubuntu2.24.04.2`, and there is no active newer build in `noble- proposed`. ## Workaround Since not being able to delete in Loupe and easilly crop and save, which are frequent actions for me I've downgraded `xdg-desktop-portal` to `1.18.3-1ubuntu1`, which sadly reopens CVE-2026-40354. Not recommended long-term. ## Loupe details ``` $ flatpak info org.gnome.Loupe Image Viewer - View and edit images ID: org.gnome.Loupe Ref: app/org.gnome.Loupe/x86_64/stable Arch: x86_64 Branch: stable Version: 50.0 License: GPL-3.0-or-later Origin: flathub Collection: org.flathub.Stable Installation: user Installed: 14,0 MB Runtime: org.gnome.Platform/x86_64/50 Sdk: org.gnome.Sdk/x86_64/50 Commit: 891e9e01bc8536b394b3c60eff3b04d1bdcf1054bc6bb876181558a6fbedf677 Parent: 48e85e6e3031453f4e1fdea40e6234e7c103cc3e6844d2e9be877c5b14095179 Subject: 50.0 (65911fe2db14) Date: 2026-03-18 15:47:24 +0000 ``` ## xdg-desktop-portal details ``` xdg-desktop-portal: Installed: 1.18.3-1ubuntu1 Candidate: 1.18.4-1ubuntu2.24.04.2 Version table: 1.18.4-1ubuntu2.24.04.2 500 500 http://security.ubuntu.com/ubuntu noble-security/main amd64 Packages 500 http://archive.ubuntu.com/ubuntu noble-updates/main amd64 Packages *** 1.18.3-1ubuntu1 500 500 http://archive.ubuntu.com/ubuntu noble/main amd64 Packages 100 /var/lib/dpkg/status ``` Note that I've searched launchpad for trash related issues and found none. I'm happy to answer any questions. ** Affects: xdg-desktop-portal (Ubuntu) Importance: Undecided Status: New ** Tags: regression-update ** Description changed: `xdg-desktop-portal 1.18.4-1ubuntu2.24.04.2` — the Noble security update for CVE-2026-40354 / USN-8287-1 — breaks `org.freedesktop.portal.Trash` for Flatpak applications whose trash/delete-to-trash operations use the portal. Reproduced directly with GNOME Loupe from Flathub on elementary OS 8.1 / Ubuntu 24.04.4. With `G_MESSAGES_DEBUG=all` enabled for `xdg-desktop- portal.service`: ``` Handling TrashFile Failed trashing file: Failed getting the parent fd ``` `gio trash` on the same file outside the sandbox succeeds. This isolates the failure to the portal path rather than the filesystem or Trash directory; `~/.local/share/Trash` is healthy and the filesystem is plain ext4. This matches the upstream regression exactly. In flatpak/xdg-desktop- portal#1972, Flatpak Nautilus fails after the CVE fix with the same: ``` Failed trashing file: Failed getting the parent fd ``` https://github.com/flatpak/xdg-desktop-portal/issues/1972 Possibly related: - Bazaar (Flatpak app store) — [bazaar-org/bazaar#1481](https://github.com/bazaar-org/bazaar/issues/1481), "Trash User Data doesn't work" - Warehouse (Flatpak data manager) — [flattool/warehouse#172](https://github.com/flattool/warehouse/issues/172), logs "Trash portal failed" removing leftover app data ## Root cause The CVE-2026-40354 fix was released upstream in xdg-desktop-portal 1.20.4 and 1.21.1. It replaced the vulnerable path-based `g_file_trash()` operation with fd-based resolution to prevent a symlink/TOCTOU attack. That change introduced a regression for Flatpak callers. Upstream fixed it in #1982 by correcting handling of the file descriptor when the caller is in a different mount namespace: https://github.com/flatpak/xdg-desktop-portal/pull/1982 #1982 merged on 2026-05-05 and was released in xdg-desktop-portal 1.21.2 on 2026-05-06, whose release notes state: > Fix a regression which broke trashing files in Flatpak (#1982). Ubuntu 24.04 tracks the older 1.18.x branch, so the CVE fix was backported to Noble as `1.18.4-1ubuntu2.24.04.2`. The Noble package changelog contains the CVE-2026-40354 backport, including the fd-based Trash implementation, but does not list the subsequent #1982 regression fix. The observed failure on Noble is the same failure reported upstream before #1982. Could the #1982 fix, or the equivalent host-mount-namespace fd handling, please be backported to the Ubuntu 24.04 package? As of 2026-09-05, `noble-updates` and `noble-security` still contain `1.18.4-1ubuntu2.24.04.2`, and there is no active newer build in `noble- proposed`. ## Workaround Since not being able to delete in Loupe and easilly crop and save, which are frequent actions for me I've downgraded `xdg-desktop-portal` to `1.18.3-1ubuntu1`, which sadly reopens CVE-2026-40354. Not recommended long-term. - Note that I've searched launchpad for trash related issues and found none. + ## Loupe details + ``` + $ flatpak info org.gnome.Loupe + + Image Viewer - View and edit images + + ID: org.gnome.Loupe + Ref: app/org.gnome.Loupe/x86_64/stable + Arch: x86_64 + Branch: stable + Version: 50.0 + License: GPL-3.0-or-later + Origin: flathub + Collection: org.flathub.Stable + Installation: user + Installed: 14,0 MB + Runtime: org.gnome.Platform/x86_64/50 + Sdk: org.gnome.Sdk/x86_64/50 + + Commit: 891e9e01bc8536b394b3c60eff3b04d1bdcf1054bc6bb876181558a6fbedf677 + Parent: 48e85e6e3031453f4e1fdea40e6234e7c103cc3e6844d2e9be877c5b14095179 + Subject: 50.0 (65911fe2db14) + Date: 2026-03-18 15:47:24 +0000 + ``` + + ## xdg-desktop-portal details + ``` + xdg-desktop-portal: + Installed: 1.18.3-1ubuntu1 + Candidate: 1.18.4-1ubuntu2.24.04.2 + Version table: + 1.18.4-1ubuntu2.24.04.2 500 + 500 http://security.ubuntu.com/ubuntu noble-security/main amd64 Packages + 500 http://archive.ubuntu.com/ubuntu noble-updates/main amd64 Packages + *** 1.18.3-1ubuntu1 500 + 500 http://archive.ubuntu.com/ubuntu noble/main amd64 Packages + 100 /var/lib/dpkg/status + ``` + + Note that I've searched launchpad for trash related issues and found + none. + I'm happy to answer any questions. -- You received this bug notification because you are a member of Ubuntu Desktop Bugs, which is subscribed to xdg-desktop-portal in Ubuntu. https://bugs.launchpad.net/bugs/2166546 Title: CVE-2026-40354 fix (USN-8287-1) breaks the Trash portal for Flatpak apps — upstream regression fix (#1982) not backported To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/xdg-desktop-portal/+bug/2166546/+subscriptions -- desktop-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/desktop-bugs
