Security Advisory catalog CVE-2026-88924
cve-program · CVE-2026-88924 Published
A flaw was found in the admin backend of gvfs. The privileged gvfsd-admin daemon changes the ownership of newly created private D-Bus sockets by calling the link-following chown() function on a pathname inside a user-controlled directory. A local attacker can exploit this via a Time-of-Check Time-of-Use (TOCTOU) race condition and exchange the socket pathname with a symbolic link pointing to an arbitrary root-owned file (such as /etc/pam.d/su). The daemon subsequently follows the symlink and changes the ownership of the targeted root-owned file to the attacker's user ID. This allows an authenticated local attacker to modify critical system files, leading to a full local privilege escalation to root.
Read the publisher's advisory Affected versions, risk and source history
cve-program · CVE-2026-88924 Published gvfs https://gitlab.gnome.org/GNOME/gvfs
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "GNOME",
"product": "gvfs",
"versions": [
{
"status": "affected",
"version": "1.48.1",
"lessThan": "1.62.0",
"versionType": "semver"
},
{
"status": "affected",
"version": "1.48.1",
"lessThan": "1.60.3",
"versionType": "semver"
},
{
"status": "affected",
"version": "1.48.1",
"lessThan": "1.58.5",
"versionType": "semver"
}
],
"packageName": "gvfs",
"collectionURL": "https://gitlab.gnome.org/GNOME/gvfs",
"defaultStatus": "unaffected"
} gvfs https://access.redhat.com/downloads/content/package-browser/
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 10",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "gvfs",
"defaultStatus": "affected",
"versions": [
{
"version": "0:1.54.4-4.el10_2.1",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/o:redhat:enterprise_linux:10.2"
]
} gvfs https://access.redhat.com/downloads/content/package-browser/
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 10",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "gvfs",
"defaultStatus": "affected",
"versions": [
{
"version": "0:1.54.4-5.el10_3.1",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/o:redhat:enterprise_linux:10.3"
]
} gvfs https://access.redhat.com/downloads/content/package-browser/
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "gvfs",
"defaultStatus": "affected",
"versions": [
{
"version": "0:1.54.4-2.el10_0.2",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/o:redhat:enterprise_linux_eus:10.0"
]
} gvfs https://access.redhat.com/downloads/content/package-browser/
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "gvfs",
"defaultStatus": "affected",
"versions": [
{
"version": "0:1.48.1-8.el9_8.1",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:enterprise_linux:9::appstream",
"cpe:/a:redhat:enterprise_linux:9::crb"
]
} gvfs https://access.redhat.com/downloads/content/package-browser/
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "gvfs",
"defaultStatus": "affected",
"versions": [
{
"version": "0:1.48.1-9.el9_9.1",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:enterprise_linux:9::appstream",
"cpe:/a:redhat:enterprise_linux:9::crb"
]
} gvfs https://access.redhat.com/downloads/content/package-browser/
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "gvfs",
"defaultStatus": "affected",
"versions": [
{
"version": "0:1.48.1-4.el9_2.1",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:rhel_e4s:9.2::appstream"
]
} gvfs https://access.redhat.com/downloads/content/package-browser/
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "gvfs",
"defaultStatus": "affected",
"versions": [
{
"version": "0:1.48.1-4.el9_4.1",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:rhel_e4s:9.4::appstream"
]
} gvfs https://access.redhat.com/downloads/content/package-browser/
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "gvfs",
"defaultStatus": "affected",
"versions": [
{
"version": "0:1.48.1-6.el9_6.1",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:rhel_eus:9.6::appstream",
"cpe:/a:redhat:rhel_eus:9.6::crb"
]
} gvfs https://access.redhat.com/downloads/content/package-browser/
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 6",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "gvfs",
"defaultStatus": "affected",
"cpes": [
"cpe:/o:redhat:rhel_els:6"
]
} gvfs https://access.redhat.com/downloads/content/package-browser/
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 7",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "gvfs",
"defaultStatus": "affected",
"cpes": [
"cpe:/o:redhat:rhel_els:7"
]
} gvfs https://access.redhat.com/downloads/content/package-browser/
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "gvfs",
"defaultStatus": "unaffected",
"cpes": [
"cpe:/a:redhat:enterprise_linux:8"
]
} Original source record · Cite this exact observation · Complete original publisher JSON