---
id: CVE-2026-88924
title: A flaw was found in the admin backend of gvfs
summary: >-
  A flaw was found in the admin backend of gvfs. The privileged gvfsd-admin
  daemon changes the ownership of newly created private D-Bus sockets by calling
  the link-following chown() function on a pathname inside a user-controlled
  directory…
severity: high
cvss: 7
cvssVector: 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-367
vendor: GNOME
product: gvfs
affected:
  - gvfs >= 1.48.1 < 1.62.0
  - gvfs >= 1.48.1 < 1.60.3
  - gvfs >= 1.48.1 < 1.58.5
  - gvfs (all versions)
  - gvfs (all versions)
  - gvfs (all versions)
  - gvfs (all versions)
  - gvfs (all versions)
patched:
  - enterprise_linux_appstream_v_10
published: '2026-09-10'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T11:17:07.130'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-88924'
references:
  - url: 'https://access.redhat.com/errata/RHSA-2026:73998'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2026:74370'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/security/cve/CVE-2026-88924'
    label: secalert@redhat.com
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2531456'
    label: secalert@redhat.com
  - url: 'https://gitlab.gnome.org/GNOME/gvfs/-/issues/875'
    label: secalert@redhat.com
  - url: 'https://gitlab.gnome.org/GNOME/gvfs/-/issues/875'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-88924.json
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-88924'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-88924'
  - url: 'https://access.redhat.com/errata/RHSA-2026:85942'
    label: 'RHSA-2026:85942'
  - url: 'https://access.redhat.com/errata/RHSA-2026:85941'
    label: 'RHSA-2026:85941'
  - url: 'https://access.redhat.com/errata/RHSA-2026:85944'
    label: 'RHSA-2026:85944'
  - url: 'https://access.redhat.com/errata/RHSA-2026:85939'
    label: 'RHSA-2026:85939'
tags:
  - nvd
  - cve.org
  - exploit-available
  - csaf
  - vex
  - red-hat
epss: 0.00223
epssPercentile: 0.12767
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-09-10T17:32:34.743791Z'
ingestedAt: '2026-09-14T11:11:19.877Z'
---

## Overview

A flaw was found in the admin backend of gvfs. The privileged gvfsd-admin daemon changes the ownership of newly created private D-Bus sockets by calling the link-following chown() function on a pathname inside a user-controlled directory. A local attacker can exploit this via a Time-of-Check Time-of-Use (TOCTOU) race condition and exchange the socket pathname with a symbolic link pointing to an arbitrary root-owned file (such as /etc/pam.d/su). The daemon subsequently follows the symlink and changes the ownership of the targeted root-owned file to the attacker's user ID. This allows an authenticated local attacker to modify critical system files, leading to a full local privilege escalation to root.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **RHSA-2026:73998** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2026-09-30 · [advisory](https://access.redhat.com/errata/RHSA-2026:73998)
- **Red Hat VEX** · Important · affected: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7 · no fix planned: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7 · updated 2026-10-20 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-88924.json)
- **RHSA-2026:74370** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) · released 2026-10-01 · [advisory](https://access.redhat.com/errata/RHSA-2026:74370)
- **RHSA-2026:85941** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0) · released 2026-10-20 · [advisory](https://access.redhat.com/errata/RHSA-2026:85941)
- **RHSA-2026:85942** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream E4S (v.9.2) · released 2026-10-20 · [advisory](https://access.redhat.com/errata/RHSA-2026:85942)
- **RHSA-2026:85944** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream E4S (v.9.4) · released 2026-10-20 · [advisory](https://access.redhat.com/errata/RHSA-2026:85944)
- **RHSA-2026:85939** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v.9.6), Red Hat CodeReady Linux Builder EUS (v.9.6) · released 2026-10-20 · [advisory](https://access.redhat.com/errata/RHSA-2026:85939)