- CVE-2026-96807: regenerate_ld_cache() created and bind-mounted the per-app .ld.so directory by path, and flatpak_switch_symlink_and_remove() swapped its "active" symlink with path-based symlink()/rename()/unlink(), so a sandboxed app could replace ~/.var/app/$APPID/.ld.so with a symlink and have ld.so cache files written at an arbitrary host location; regenerate_ld_cache() now opens the directory with glnx_chase_and_mkdirat(), works on it with *at() syscalls and passes it to bwrap with --bind-fd, and flatpak_switch_symlink_and_remove() takes the directory fd and uses symlinkat()/renameat()/unlinkat() - Fix flatpak_switch_symlink_and_remove() returning -1 (truthy) instead of FALSE on one error path