- Rebase onto the vendor 1.12.9-4.el9_8.4 sources, which prevent an arbitrary write as root via extra-data extraction (CVE-2026-96275) and harden the OCI delta parser against size overflow (CVE-2026-96280) - Retained the TuxCare hardening of regenerate_ld_cache() in common/flatpak-run.c and of flatpak_switch_symlink_and_remove() in common/flatpak-utils.c, which the vendor sources still lack - The TuxCare duplicate of the data-dir and /var symlink hardening for common/flatpak-run.c plus the libglnx chase prerequisites is dropped; the vendor's run-harden-ensure-data-dir-and-var-setup-against-symlink-attacks, chase-add-internal-glnx-chaseat-full-for-a-strategic-callback and chase-add-glnx-chase-and-mkdirat patches carry the same fix - Keep the retry of openat2() on EAGAIN in libglnx glnx_chaseat(), which the dropped TuxCare patch carried and the vendor's chase patches leave out - The TuxCare duplicate for revokefs/writer.c is dropped; the vendor's revokefs-avoid-symlink-path-traversal-* patches carry the same fix