bubblewrap EUVD-2026-28884

Immediate action for systems running bubblewrap 0.11.0 or 0.11.1 with setuid bit: upgrade to bubblewrap v0.11.2 from https://github.com/containers/bubblewrap/releases/tag/v0.11.2, which sets the non-dumpable flag during privilege transitions to prevent ptrace attachment (security advisory at https://github.com/containers/bubblewrap/security/advisories/GHSA-xq78-7hw4-5jvp). Long-term mitigation per vendor recommendation: transition away from setuid mode entirely by recompiling bubblewrap with -Dsupport_setuid=false (now the default build option), which refuses execution if setuid bit is set and eliminates this entire attack surface. For environments unable to immediately patch, temporary workaround is to remove setuid bit via 'chmod u-s /usr/bin/bwrap' - note this breaks functionality for users without CAP_SYS_ADMIN or unprivileged user namespace support, potentially preventing Flatpak applications from launching on older kernels. Verify kernel supports unprivileged user namespaces (kernel.unprivileged_userns_clone=1 on Debian/Ubuntu derivatives) before removing setuid as alternative privilege model. No performance or compatibility penalty for user-namespace mode on kernel 3.8+ systems.