{"id":"CVE-2026-88924","title":"Gvfs: gvfs-admin socket ownership race permits local root","summary":"A flaw was found in the admin backend of gvfs. The privileged gvfsd-admin daemon changes the ownership of newly created private D-Bus sockets by calling the link-following chown() function on a pathname inside a user-controlled directory…","severity":"high","cvss":7,"cvssVector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","cwe":["CWE-367"],"vendor":"GNOME","product":"gvfs","affected":["gvfs >= 1.48.1 < 1.62.0","gvfs >= 1.48.1 < 1.60.3","gvfs >= 1.48.1 < 1.58.5","gvfs (all versions)","gvfs (all versions)","gvfs (all versions)","gvfs (all versions)","gvfs (all versions)"],"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"total","timestamp":"2026-09-10T17:32:34.743791Z"},"exploitAvailable":true,"published":"2026-09-10","updated":"2026-09-11","sourceUpdated":"2026-09-11T21:19:18.368Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-88924","references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-88924"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2531456","label":"RHBZ#2531456"},{"url":"https://gitlab.gnome.org/GNOME/gvfs/-/issues/875"}],"tags":["cve.org","exploit-available"],"epss":0.00171,"epssPercentile":0.06847,"ingestedAt":"2026-09-14T11:11:19.877Z","slug":"CVE-2026-88924","body":"## Overview\n\nA flaw was found in the admin backend of gvfs. The privileged gvfsd-admin daemon changes the ownership of newly created private D-Bus sockets by calling the link-following chown() function on a pathname inside a user-controlled directory. A local attacker can exploit this via a Time-of-Check Time-of-Use (TOCTOU) race condition and exchange the socket pathname with a symbolic link pointing to an arbitrary root-owned file (such as /etc/pam.d/su). The daemon subsequently follows the symlink and changes the ownership of the targeted root-owned file to the attacker's user ID. This allows an authenticated local attacker to modify critical system files, leading to a full local privilege escalation to root.\n\n## Affected\n\n- `gvfs >= 1.48.1 < 1.62.0`\n- `gvfs >= 1.48.1 < 1.60.3`\n- `gvfs >= 1.48.1 < 1.58.5`\n- `gvfs (all versions)`\n- `gvfs (all versions)`\n- `gvfs (all versions)`\n- `gvfs (all versions)`\n- `gvfs (all versions)`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n### Workarounds\n\nTo mitigate this issue, adjust Polkit rules to require password authentication to start gvfsd-admin or remove execute permissions of the gvfsd-admin binary to prevent execution.","depth":"midnight","depthScore":51,"depthScoreParts":{"impact":38.5,"likelihood":0,"exploitation":12,"ransomware":0},"changes":[{"seq":52160,"id":"CVE-2026-88924","ts":1789063373816,"field":"exploit_available","old":"false","new":"true"}]}