EUVD-2026-36637
GHSA-6pjg-wmm6-r8rp
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local authenticated user racing a TOCTOU window justifies AV:L/AC:H/PR:L; primitive is root-owned file write so I:H, with limited confidentiality and availability impact.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
A time-of-check time-of-use (TOCTOU) race condition was found in the abrt-dbus D-Bus service's SetElement method. Between dump directory creation and post-create event execution, any local user can call SetElement to write arbitrary text files into the root-owned dump directory, bypassing package validation and allowing crashes of unpackaged binaries to survive post-create processing.
AnalysisAI
Local privilege escalation in the abrt-dbus D-Bus service on Red Hat Enterprise Linux 6, 7, and 8 allows any unprivileged local user to win a TOCTOU race against the SetElement method, writing arbitrary text files into root-owned dump directories. By exploiting the gap between dump directory creation and post-create event execution, an attacker bypasses package validation and persists crash data for unpackaged binaries inside privileged paths, with no public exploit identified at time of analysis.
Technical ContextAI
abrt (Automatic Bug Reporting Tool) exposes a D-Bus interface that lets local users submit crash data; the SetElement method writes named elements into a per-crash dump directory owned by root. The flaw is a classic CWE-367 Time-of-Check Time-of-Use race: abrt-dbus validates the dump directory state at creation, but a concurrent SetElement call from a local user can mutate the directory contents before the post-create event handler runs its package-ownership and policy checks. Because abrt's post-create hooks normally discard crashes from unpackaged binaries, winning the race lets attacker-controlled text files survive into a root-owned directory that would otherwise be cleaned up, undermining a security control the rest of the abrt pipeline relies on.
RemediationAI
No vendor-released patch version is identified at time of analysis in the supplied data, so monitor https://access.redhat.com/security/cve/CVE-2026-54228 and Bugzilla 2488531 and apply the abrt/abrt-dbus errata for each RHEL stream as soon as Red Hat publishes them, prioritizing RHEL 8 where standard maintenance still applies and using Extended Lifecycle Support channels for RHEL 6/7 if available. As compensating controls until patches land, stop and mask the abrt-dbus service (systemctl mask abrtd abrt-dbus) on systems that do not actively rely on automatic crash reporting, accepting that local crashes will no longer be collected for support cases; alternatively, restrict the org.freedesktop.problems D-Bus interface via a polkit/D-Bus policy that limits SetElement to administrators, which preserves crash collection for privileged users but breaks user-space crash uploads. Avoid generic hardening alone - the race is in privileged code, so SELinux in enforcing mode and tight /var/spool/abrt permissions reduce but do not eliminate exposure.
More in Red Hat Enterprise Linux 6
View allRemote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter
Out-of-bounds read in the GnuTLS DTLS handshake reassembly logic lets remote unauthenticated attackers trigger an intege
Local privilege escalation in Performance Co-Pilot (PCP) on Red Hat Enterprise Linux 6 through 10 and OpenShift Containe
Denial of service in Red Hat / 389 Directory Server (389-ds-base, versions since ~1.3.2/2013) allows an authenticated LD
Local-to-domain-wide root privilege escalation in SSSD's LDAP sudo provider allows an authenticated LDAP directory user
Heap buffer overflow in GStreamer's librfb (RFB/VNC client) allows a malicious VNC server to corrupt heap memory on a co
Confidential Active Directory attribute disclosure in Samba's Active Directory Domain Controller allows an authenticated
Information disclosure and denial of service in GnuTLS (libgnutls) let a remote, unauthenticated attacker trigger a heap
Remote denial-of-service in libssh 0.11.x and earlier allows unauthenticated attackers to crash SSH server daemon proces
Here is the multi-source synthesis as a single JSON object: ```json { "product_name": "GnuTLS", "summary": "Certifi
Privilege escalation to root and Kerberos-based authentication bypass in SSSD's Active Directory GPO provider affects Re
Same technique Denial Of Service
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today