CVE-2026-88924

A flaw was found in the admin backend of gvfs. The privileged gvfsd-admin daemon changes the ownership of newly created private D-Bus sockets by calling the link-following chown() function on a pathname inside a user-controlled directory. A local attacker can exploit this via a Time-of-Check Time-of-Use (TOCTOU) race condition and exchange the socket pathname with a symbolic link pointing to an arbitrary root-owned file (such as /etc/pam.d/su). The daemon subsequently follows the symlink and changes the ownership of the targeted root-owned file to the attacker's user ID. This allows an authenticated local attacker to modify critical system files, leading to a full local privilege escalation to root.

Database specific

{
    "cna_assigner": "redhat",
    "cwe_ids": [
        "CWE-367"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/88xxx/CVE-2026-88924.json"
}

References

Affected packages

Git / gitlab.gnome.org/gnome/gvfs

Affected ranges

Type

GIT

Repo

https://gitlab.gnome.org/gnome/gvfs

Events

Introduced

a971ec4b5c1ff016e7273f2d390248f8c2d65106

Fixed

046d5423ef100255f554eff84388f8ba765a2182

Fixed

bbf41f8a234bef8e51c012d68e78ce43fd8a6751

Fixed

d871ae97ece1168701fa3e650efcdc552aea80a0

Database specific

Show details

{
    "extracted_events": [
        {
            "introduced": "1.48.1"
        },
        {
            "fixed": "1.62.0"
        },
        {
            "fixed": "1.60.3"
        },
        {
            "fixed": "1.58.5"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

1.*

1.48.1

1.49.1

1.49.90

1.50.0

1.50.1

1.50.2

1.50.3

1.50.4

1.51.1

1.51.90

1.51.91

1.52.0

1.52.1

1.53.1

1.53.90

1.53.91

1.54.0

1.54.1

1.55.1

1.55.90

1.56.0

1.56.1

1.57.1

1.57.2

1.58.0

1.58.1

1.58.2

1.58.3

1.58.4

1.59.1

1.59.90

1.60.0

1.60.1

1.60.2

1.61.1

1.61.90

1.61.91

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-88924.json"