Skip to content
Fencer Vulns
high 7.0

CVE-2026-88924 json

Gvfs: gvfs-admin socket ownership race permits local root

published 2026-09-10 59 d ago modified 2026-11-05 4 d ago also EUVD-2026-75537

cvss
7.0
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.2%
EPSS 0.2% chance of exploitation in 30 days, percentile 12%
public exploits
0
none known

Summary

A flaw was found in the admin backend of gvfs. The privileged gvfsd-admin daemon changes the ownership of newly created private D-Bus sockets by calling the link-following chown() function on a pathname inside a user-controlled directory. A local attacker can exploit this via a Time-of-Check Time-of-Use (TOCTOU) race condition and exchange the socket pathname with a symbolic link pointing to an arbitrary root-owned file (such as /etc/pam.d/su). The daemon subsequently follows the symlink and changes the ownership of the targeted root-owned file to the attacker's user ID. This allows an authenticated local attacker to modify critical system files, leading to a full local privilege escalation to root.

Patch / fix

  • GNOME gvfs 1.58.5, 1.60.3, 1.62.0
  • Red Hat Red Hat Enterprise Linux 10 0:1.54.4-4.el10_2.1
  • Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support 0:1.54.4-2.el10_0.2
  • Red Hat Red Hat Enterprise Linux 9 0:1.48.1-8.el9_8.1
  • Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions 0:1.48.1-4.el9_2.1
  • Red Hat Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions 0:1.48.1-4.el9_4.1
  • Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support 0:1.48.1-6.el9_6.1
  • gvfs Debian 14 1.62.0-1

debian advisories DEBIAN-CVE-2026-88924

  • gvfs Ubuntu 22.04 LTS 1.48.2-0ubuntu1.2
  • gvfs Ubuntu 24.04 LTS 1.54.4-0ubuntu1~24.04.4
  • gvfs Ubuntu 26.04 LTS 1.60.0-1ubuntu0.1

ubuntu advisories UBUNTU-CVE-2026-88924

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • gvfs RHEL 9 1.48.1-8.el9_8.1
  • gvfs-goa RHEL 9 1.48.1-8.el9_8.1
  • gvfs-mtp RHEL 9 1.48.1-8.el9_8.1
  • gvfs-smb RHEL 9 1.48.1-8.el9_8.1
  • gvfs-fuse RHEL 9 1.48.1-8.el9_8.1
  • gvfs-client RHEL 9 1.48.1-8.el9_8.1
  • gvfs-gphoto2 RHEL 9 1.48.1-8.el9_8.1
  • gvfs RHEL 10.2 1.54.4-4.el10_2.1

red hat advisories RHSA-2026:74370RHSA-2026:73998

  • gvfs SLES for SAP 15 SP5, SLES for SAP 15 SP4, SLES 15 SP5-LTSS +5 more 1.48.2-150400.4.18.1
  • gvfs SLES for SAP 15 SP6, SLES 15 SP6-LTSS, SLE Module for Desktop Applications 15 SP7 1.52.2-150600.3.12.1
  • gvfs SLES for SAP applications 16.0, SLES 16.0 1.59.90-160000.4.1

suse advisories SUSE-SU-2026:5080-1SUSE-SU-2026:5065-1SUSE-SU-2026:24466-1

  • gvfs openSUSE Leap 16.0 1.59.90-160000.4.1
  • gvfs openSUSE Tumbleweed 1.60.3-1.1

opensuse advisories openSUSE-SU-2026:22174-1openSUSE-SU-2026:11788-1

  • gvfs AlmaLinux 9 1.48.1-8.el9_8.1
  • gvfs-goa AlmaLinux 9 1.48.1-8.el9_8.1
  • gvfs-mtp AlmaLinux 9 1.48.1-8.el9_8.1
  • gvfs-smb AlmaLinux 9 1.48.1-8.el9_8.1
  • gvfs-fuse AlmaLinux 9 1.48.1-8.el9_8.1
  • gvfs-client AlmaLinux 9 1.48.1-8.el9_8.1
  • gvfs-gphoto2 AlmaLinux 9 1.48.1-8.el9_8.1
  • gvfs AlmaLinux 10 1.54.4-4.el10_2.1

almalinux advisories ALSA-2026:74370ALSA-2026:73998

  • gvfs Rocky Linux 9 1.48.1-8.el9_8.1
  • gvfs Rocky Linux 10 1.54.4-4.el10_2.1

rocky linux advisories RLSA-2026:74370RLSA-2026:73998

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-88924 updated cvss 7.0

gvfs: gvfs-admin socket ownership race permits local root

  • Red Hat Enterprise Linux 6 gvfs-afc, gvfs-smb, gvfs-fuse, gvfs-archive, gvfs-gphoto2, gvfs-obexftp, +1 more Red Hat Enterprise Linux 7 gvfs, gvfs-afc, gvfs-afp, gvfs-goa, gvfs-mtp, gvfs-smb, +6 more
    affected: workaround, no fix planned “To mitigate this issue, adjust Polkit rules to require password authentication to start gvfsd-admin or remove execute permissions of the gvfsd-admin binary to prevent execution.”
  • Red Hat CodeReady Linux Builder EUS (v.9.6) gvfs 1.48.1-6.el9_6.1
    fixed: vendor fix “To mitigate this issue, adjust Polkit rules to require password authentication to start gvfsd-admin or remove execute permissions of the gvfsd-admin binary to prevent execution.” RHSA-2026:85939
  • Red Hat Enterprise Linux AppStream (v. 9) gvfs 1.48.1-8.el9_8.1, gvfs-goa 1.48.1-8.el9_8.1, gvfs-mtp 1.48.1-8.el9_8.1, gvfs-smb 1.48.1-8.el9_8.1, gvfs-fuse 1.48.1-8.el9_8.1, gvfs-client 1.48.1-8.el9_8.1, +1 more
    fixed: vendor fix “To mitigate this issue, adjust Polkit rules to require password authentication to start gvfsd-admin or remove execute permissions of the gvfsd-admin binary to prevent execution.” RHSA-2026:74370
  • Red Hat Enterprise Linux AppStream (v. 10) gvfs 1.54.4-4.el10_2.1, gvfs-goa 1.54.4-4.el10_2.1, gvfs-mtp 1.54.4-4.el10_2.1, gvfs-smb 1.54.4-4.el10_2.1, gvfs-fuse 1.54.4-4.el10_2.1, gvfs-client 1.54.4-4.el10_2.1, +1 more
    fixed: vendor fix “To mitigate this issue, adjust Polkit rules to require password authentication to start gvfsd-admin or remove execute permissions of the gvfsd-admin binary to prevent execution.” RHSA-2026:73998
  • Red Hat Enterprise Linux AppStream E4S (v.9.2) gvfs 1.48.1-4.el9_2.1, gvfs-goa 1.48.1-4.el9_2.1, gvfs-mtp 1.48.1-4.el9_2.1, gvfs-smb 1.48.1-4.el9_2.1, gvfs-fuse 1.48.1-4.el9_2.1, gvfs-client 1.48.1-4.el9_2.1, +1 more
    fixed: vendor fix “To mitigate this issue, adjust Polkit rules to require password authentication to start gvfsd-admin or remove execute permissions of the gvfsd-admin binary to prevent execution.” RHSA-2026:85942
  • Red Hat Enterprise Linux AppStream E4S (v.9.4) gvfs 1.48.1-4.el9_4.1, gvfs-goa 1.48.1-4.el9_4.1, gvfs-mtp 1.48.1-4.el9_4.1, gvfs-smb 1.48.1-4.el9_4.1, gvfs-fuse 1.48.1-4.el9_4.1, gvfs-client 1.48.1-4.el9_4.1, +1 more
    fixed: vendor fix “To mitigate this issue, adjust Polkit rules to require password authentication to start gvfsd-admin or remove execute permissions of the gvfsd-admin binary to prevent execution.” RHSA-2026:85944
  • Red Hat Enterprise Linux AppStream EUS (v. 10.0) gvfs 1.54.4-2.el10_0.2, gvfs-goa 1.54.4-2.el10_0.2, gvfs-mtp 1.54.4-2.el10_0.2, gvfs-smb 1.54.4-2.el10_0.2, gvfs-fuse 1.54.4-2.el10_0.2, gvfs-client 1.54.4-2.el10_0.2, +1 more
    fixed: vendor fix “To mitigate this issue, adjust Polkit rules to require password authentication to start gvfsd-admin or remove execute permissions of the gvfsd-admin binary to prevent execution.” RHSA-2026:85941
  • Red Hat Enterprise Linux AppStream EUS (v.9.6) gvfs 1.48.1-6.el9_6.1, gvfs-goa 1.48.1-6.el9_6.1, gvfs-mtp 1.48.1-6.el9_6.1, gvfs-smb 1.48.1-6.el9_6.1, gvfs-fuse 1.48.1-6.el9_6.1, gvfs-client 1.48.1-6.el9_6.1, +1 more
    fixed: vendor fix “To mitigate this issue, adjust Polkit rules to require password authentication to start gvfsd-admin or remove execute permissions of the gvfsd-admin binary to prevent execution.” RHSA-2026:85939
show 2 more
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) gvfs 1.48.1-8.el9_8.1
    fixed: vendor fix “To mitigate this issue, adjust Polkit rules to require password authentication to start gvfsd-admin or remove execute permissions of the gvfsd-admin binary to prevent execution.” RHSA-2026:74370
  • Red Hat Enterprise Linux 8 gvfs, gvfs-afc, gvfs-afp, gvfs-goa, gvfs-mtp, gvfs-smb, +5 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
no
Technical impact
total
Assessed
59 d ago

Exploit prediction

0.22% chance of exploitation in the next 30 days, higher than 12% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • gitlab.gnome.org https://gitlab.gnome.org/GNOME/gvfs/-/issues/875 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

  • GNOME gvfs
  • Red Hat Red Hat Enterprise Linux 10
  • Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support
  • Red Hat Red Hat Enterprise Linux 9
  • Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support
  • Red Hat Red Hat Enterprise Linux 6
  • Red Hat Red Hat Enterprise Linux 7
  • Red Hat Red Hat Enterprise Linux 8

Classification

Weakness
  • CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.