---
id: CVE-2026-88924
title: 'Gvfs: gvfs-admin socket ownership race permits local root'
summary: >-
  A flaw was found in the admin backend of gvfs. The privileged gvfsd-admin
  daemon changes the ownership of newly created private D-Bus sockets by calling
  the link-following chown() function on a pathname inside a user-controlled
  directory…
severity: high
cvss: 7
cvssVector: 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-367
vendor: GNOME
product: gvfs
affected:
  - gvfs >= 1.48.1 < 1.62.0
  - gvfs >= 1.48.1 < 1.60.3
  - gvfs >= 1.48.1 < 1.58.5
  - gvfs (all versions)
  - gvfs (all versions)
  - gvfs (all versions)
  - gvfs (all versions)
  - gvfs (all versions)
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-09-10T17:32:34.743791Z'
exploitAvailable: true
published: '2026-09-10'
updated: '2026-09-11'
sourceUpdated: '2026-09-11T21:19:18.368Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-88924'
references:
  - url: 'https://access.redhat.com/security/cve/CVE-2026-88924'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2531456'
    label: RHBZ#2531456
  - url: 'https://gitlab.gnome.org/GNOME/gvfs/-/issues/875'
tags:
  - cve.org
  - exploit-available
epss: 0.00171
epssPercentile: 0.06854
ingestedAt: '2026-09-14T11:11:19.877Z'
---

## Overview

A flaw was found in the admin backend of gvfs. The privileged gvfsd-admin daemon changes the ownership of newly created private D-Bus sockets by calling the link-following chown() function on a pathname inside a user-controlled directory. A local attacker can exploit this via a Time-of-Check Time-of-Use (TOCTOU) race condition and exchange the socket pathname with a symbolic link pointing to an arbitrary root-owned file (such as /etc/pam.d/su). The daemon subsequently follows the symlink and changes the ownership of the targeted root-owned file to the attacker's user ID. This allows an authenticated local attacker to modify critical system files, leading to a full local privilege escalation to root.

## Affected

- `gvfs >= 1.48.1 < 1.62.0`
- `gvfs >= 1.48.1 < 1.60.3`
- `gvfs >= 1.48.1 < 1.58.5`
- `gvfs (all versions)`
- `gvfs (all versions)`
- `gvfs (all versions)`
- `gvfs (all versions)`
- `gvfs (all versions)`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

### Workarounds

To mitigate this issue, adjust Polkit rules to require password authentication to start gvfsd-admin or remove execute permissions of the gvfsd-admin binary to prevent execution.