Log in Start free

Vulnerability · Published Sep 10, 2026 · Assigned by redhat

CVE-2026-88924Gvfs: gvfs-admin socket ownership race permits local root

High 7.0

In plain English

A high-severity security flaw in gvfs from GNOME. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 13% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.0High
Exploit odds (30 days)0.2%top 87.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A flaw was found in the admin backend of gvfs. The privileged gvfsd-admin daemon changes the ownership of newly created private D-Bus sockets by calling the link-following chown() function on a pathname inside a user-controlled directory. A local attacker can exploit this via a Time-of-Check Time-of-Use (TOCTOU) race condition and exchange the socket pathname with a symbolic link pointing to an arbitrary root-owned file (such as /etc/pam.d/su). The daemon subsequently follows the symlink and changes the ownership of the targeted root-owned file to the attacker's user ID. This allows an authenticated local attacker to modify critical system files, leading to a full local privilege escalation to root.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:10gvfs1.54.4-4.el10_2.1ALSA-2026:73998
AlmaLinux:9gvfs1.48.1-8.el9_8.1ALSA-2026:74370
AlmaLinux:10gvfs-client1.54.4-4.el10_2.1ALSA-2026:73998
AlmaLinux:9gvfs-client1.48.1-8.el9_8.1ALSA-2026:74370
AlmaLinux:9gvfs-devel1.48.1-8.el9_8.1ALSA-2026:74370
AlmaLinux:10gvfs-fuse1.54.4-4.el10_2.1ALSA-2026:73998
AlmaLinux:9gvfs-fuse1.48.1-8.el9_8.1ALSA-2026:74370
AlmaLinux:10gvfs-goa1.54.4-4.el10_2.1ALSA-2026:73998
AlmaLinux:9gvfs-goa1.48.1-8.el9_8.1ALSA-2026:74370
AlmaLinux:10gvfs-gphoto21.54.4-4.el10_2.1ALSA-2026:73998
AlmaLinux:9gvfs-gphoto21.48.1-8.el9_8.1ALSA-2026:74370
AlmaLinux:10gvfs-mtp1.54.4-4.el10_2.1ALSA-2026:73998
AlmaLinux:9gvfs-mtp1.48.1-8.el9_8.1ALSA-2026:74370
AlmaLinux:10gvfs-smb1.54.4-4.el10_2.1ALSA-2026:73998
AlmaLinux:9gvfs-smb1.48.1-8.el9_8.1ALSA-2026:74370
Debian:12gvfsno fix listedDEBIAN-CVE-2026-88924
Debian:13gvfsno fix listedDEBIAN-CVE-2026-88924
Debian:14gvfs1.62.0-1DEBIAN-CVE-2026-88924
Rocky Linux:10gvfs0:1.54.4-4.el10_2.1RLSA-2026:73998
Rocky Linux:9gvfs0:1.48.1-8.el9_8.1RLSA-2026:74370
Ubuntu:22.04:LTSgvfs1.48.2-0ubuntu1.2UBUNTU-CVE-2026-88924
Ubuntu:22.04:LTSgvfs1.48.2-0ubuntu1.2USN-8845-1
Ubuntu:24.04:LTSgvfs1.54.4-0ubuntu1~24.04.4UBUNTU-CVE-2026-88924
Ubuntu:24.04:LTSgvfs1.54.4-0ubuntu1~24.04.4USN-8845-1
Ubuntu:26.04:LTSgvfs1.60.0-1ubuntu0.1USN-8845-1
Ubuntu:26.04:LTSgvfs1.60.0-1ubuntu0.1UBUNTU-CVE-2026-88924

Affected products (as reported)

VendorProductVersions
GNOME gvfs 1.48.1 – before 1.62.01.48.1 – before 1.60.31.48.1 – before 1.58.5
Red Hat Red Hat Enterprise Linux 10 see references
Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support see references
Red Hat Red Hat Enterprise Linux 9 see references
Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions see references
Red Hat Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions see references
Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support see references
Red Hat Red Hat Enterprise Linux 6 see references
Red Hat Red Hat Enterprise Linux 7 see references
Red Hat Red Hat Enterprise Linux 8 see references

Weakness: CWE-367 · Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

References