A flaw was found in the admin backend of gvfs. The privileged gvfsd-admin daemon changes the ownership of newly created private D-Bus sockets by calling the link-following chown() function on a pathname inside a user-controlled directory. A local attacker can exploit this via a Time-of-Check Time-of-Use (TOCTOU) race condition and exchange the socket pathname with a symbolic link pointing to an arbitrary root-owned file (such as /etc/pam.d/su). The daemon subsequently follows the symlink and changes the ownership of the targeted root-owned file to the attacker's user ID. This allows an authenticated local attacker to modify critical system files, leading to a full local privilege escalation to root.
References
Configurations
No configuration.
History
21 Oct 2026, 00:17
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
20 Oct 2026, 15:17
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
20 Oct 2026, 14:17
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
01 Oct 2026, 17:17
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
01 Oct 2026, 04:18
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
Information
Published : 2026-09-10 15:17
Updated : 2026-10-21 00:17
NVD link : CVE-2026-88924
Mitre link : CVE-2026-88924
CVE.ORG link : CVE-2026-88924
JSON object : View
Products Affected
No product.
CWE
CWE-367
Time-of-check Time-of-use (TOCTOU) Race Condition