{"id":"CVE-2026-88924","title":"A flaw was found in the admin backend of gvfs","summary":"A flaw was found in the admin backend of gvfs. The privileged gvfsd-admin daemon changes the ownership of newly created private D-Bus sockets by calling the link-following chown() function on a pathname inside a user-controlled directory…","severity":"high","cvss":7,"cvssVector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-367"],"vendor":"GNOME","product":"gvfs","affected":["gvfs >= 1.48.1 < 1.62.0","gvfs >= 1.48.1 < 1.60.3","gvfs >= 1.48.1 < 1.58.5","gvfs (all versions)","gvfs (all versions)","gvfs (all versions)","gvfs (all versions)","gvfs (all versions)"],"patched":["enterprise_linux_appstream_v_10"],"published":"2026-09-10","updated":"2026-10-14","sourceUpdated":"2026-10-14T11:17:07.130","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-88924","references":[{"url":"https://access.redhat.com/errata/RHSA-2026:73998","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:74370","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/security/cve/CVE-2026-88924","label":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2531456","label":"secalert@redhat.com"},{"url":"https://gitlab.gnome.org/GNOME/gvfs/-/issues/875","label":"secalert@redhat.com"},{"url":"https://gitlab.gnome.org/GNOME/gvfs/-/issues/875","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-88924.json"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-88924"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88924"},{"url":"https://access.redhat.com/errata/RHSA-2026:85942","label":"RHSA-2026:85942"},{"url":"https://access.redhat.com/errata/RHSA-2026:85941","label":"RHSA-2026:85941"},{"url":"https://access.redhat.com/errata/RHSA-2026:85944","label":"RHSA-2026:85944"},{"url":"https://access.redhat.com/errata/RHSA-2026:85939","label":"RHSA-2026:85939"}],"tags":["nvd","cve.org","exploit-available","csaf","vex","red-hat"],"epss":0.00223,"epssPercentile":0.12767,"exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"total","timestamp":"2026-09-10T17:32:34.743791Z"},"ingestedAt":"2026-09-14T11:11:19.877Z","slug":"CVE-2026-88924","body":"## Overview\n\nA flaw was found in the admin backend of gvfs. The privileged gvfsd-admin daemon changes the ownership of newly created private D-Bus sockets by calling the link-following chown() function on a pathname inside a user-controlled directory. A local attacker can exploit this via a Time-of-Check Time-of-Use (TOCTOU) race condition and exchange the socket pathname with a symbolic link pointing to an arbitrary root-owned file (such as /etc/pam.d/su). The daemon subsequently follows the symlink and changes the ownership of the targeted root-owned file to the attacker's user ID. This allows an authenticated local attacker to modify critical system files, leading to a full local privilege escalation to root.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **RHSA-2026:73998** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2026-09-30 · [advisory](https://access.redhat.com/errata/RHSA-2026:73998)\n- **Red Hat VEX** · Important · affected: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7 · no fix planned: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7 · updated 2026-10-20 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-88924.json)\n- **RHSA-2026:74370** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) · released 2026-10-01 · [advisory](https://access.redhat.com/errata/RHSA-2026:74370)\n- **RHSA-2026:85941** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0) · released 2026-10-20 · [advisory](https://access.redhat.com/errata/RHSA-2026:85941)\n- **RHSA-2026:85942** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream E4S (v.9.2) · released 2026-10-20 · [advisory](https://access.redhat.com/errata/RHSA-2026:85942)\n- **RHSA-2026:85944** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream E4S (v.9.4) · released 2026-10-20 · [advisory](https://access.redhat.com/errata/RHSA-2026:85944)\n- **RHSA-2026:85939** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v.9.6), Red Hat CodeReady Linux Builder EUS (v.9.6) · released 2026-10-20 · [advisory](https://access.redhat.com/errata/RHSA-2026:85939)","depth":"midnight","depthScore":51,"depthScoreParts":{"impact":38.5,"likelihood":0,"exploitation":12,"ransomware":0},"changes":[{"seq":52160,"id":"CVE-2026-88924","ts":1789063373816,"field":"exploit_available","old":"false","new":"true"}]}