CVE-2026-88924

A flaw was found in the admin backend of gvfs. The privileged gvfsd-admin daemon changes the ownership of newly created private D-Bus sockets by calling the link-following chown() function on a pathname inside a user-controlled directory. A local attacker can exploit this via a Time-of-Check Time-of-Use (TOCTOU) race condition and exchange the socket pathname with a symbolic link pointing to an arbitrary root-owned file (such as /etc/pam.d/su). The daemon subsequently follows the symlink and changes the ownership of the targeted root-owned file to the attacker's user ID. This allows an authenticated local attacker to modify critical system files, leading to a full local privilege escalation to root.

Database specific

{
    "cna_assigner": "redhat",
    "cwe_ids": [
        "CWE-367"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/88xxx/CVE-2026-88924.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "range": [
                        {
                            "fixed": "0:1.54.4-4.el10_2.1"
                        },
                        {
                            "fixed": "0:1.54.4-2.el10_0.2"
                        },
                        {
                            "fixed": "0:1.48.1-8.el9_8.1"
                        },
                        {
                            "fixed": "0:1.48.1-4.el9_2.1"
                        },
                        {
                            "fixed": "0:1.48.1-4.el9_4.1"
                        },
                        {
                            "fixed": "0:1.48.1-6.el9_6.1"
                        }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "InverseAffectedRanges"
                }
            ]
        }
    ]
}

References

Affected packages

Git / gitlab.gnome.org/gnome/gvfs

Affected ranges

Type

GIT

Repo

https://gitlab.gnome.org/gnome/gvfs

Events

Introduced

a971ec4b5c1ff016e7273f2d390248f8c2d65106

Fixed

046d5423ef100255f554eff84388f8ba765a2182

Fixed

bbf41f8a234bef8e51c012d68e78ce43fd8a6751

Fixed

d871ae97ece1168701fa3e650efcdc552aea80a0

Database specific

Show details

{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "1.48.1"
                },
                {
                    "fixed": "1.62.0"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandardRange"
        },
        {
            "range": [
                {
                    "introduced": "1.48.1"
                },
                {
                    "fixed": "1.60.3"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandardRange"
        },
        {
            "range": [
                {
                    "introduced": "1.48.1"
                },
                {
                    "fixed": "1.58.5"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandardRange"
        }
    ]
}

Affected versions

1.*

1.48.1

1.49.1

1.49.90

1.50.0

1.50.1

1.50.2

1.50.3

1.50.4

1.51.1

1.51.90

1.51.91

1.52.0

1.52.1

1.53.1

1.53.90

1.53.91

1.54.0

1.54.1

1.55.1

1.55.90

1.56.0

1.56.1

1.57.1

1.57.2

1.58.0

1.58.1

1.58.2

1.58.3

1.58.4

1.59.1

1.59.90

1.60.0

1.60.1

1.60.2

1.61.1

1.61.90

1.61.91

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-88924.json"