Skip to main content

gvfs EUVDEUVD-2026-75537

| CVE-2026-88924 HIGH
Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367)
2026-09-10 redhat GHSA-8w8m-36rw-gg63
Privilege Escalation Red Hat Enterprise Linux 10 Red Hat Enterprise Linux 6 Red Hat Enterprise Linux 7 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 9 Red Hat
7.0
CVSS 3.1 · Vendor: redhat
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Gain low-privilege local shell
  2. Delivery
    Trigger gvfsd-admin D-Bus socket creation
  3. Exploit
    Race to replace socket path with symlink to /etc/pam.d/su
  4. Execution
    Daemon follows symlink and chown() transfers file ownership
  5. Persist
    Modify PAM configuration to allow passwordless root
  6. Impact
    Escalate to root via su

Vulnerability Assessment

Weakness
CWE
CWE-367
ASVS 5.0
V15 - Secure Coding and Architecture TOCTOU prevention
Exploitation Conditions

Exploitation requires: (1) a local, authenticated user account with at minimum low-privilege access to the target system (PR:L per CVSS); (2) the gvfsd-admin daemon must be active, which occurs on systems running the GNOME desktop environment - headless or server RHEL installations without GNOME are not affected; (3) the attacker must control or influence a directory path that gvfsd-admin uses during D-Bus socket creation; (4) the attacker must successfully win a kernel-scheduler-dependent timing race, which is not guaranteed and may require many iterations, especially under low system load or with certain CPU scheduling policies (AC:H). There is no network exploitation path; AV:L confirms this is strictly a local vector. Non-GNOME RHEL deployments and containerized workloads without the GNOME stack present are outside the attack surface.
Impact

The CVSS 3.1 vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H accurately captures the risk profile: exploitation requires a local account (PR:L) and the ability to win a timing race (AC:H), but delivers complete system compromise (C:H/I:H/A:H) once successful. AC:H tempers raw urgency somewhat - TOCTOU exploits require repeated attempts and are sensitive to system load and scheduler behavior - but the ultimate payoff of root access via PAM or other critical file ownership transfer is severe. No public exploit code has been identified at time of analysis, and the CVE is not listed in CISA KEV, suggesting the threat is currently theoretical or targeted rather than widespread. Even so, a mid-sized municipal IT team in mielec running GNOME-based RHEL workstations should treat this as urgent patching, given that the threat model for desktop Linux privilege escalation squarely involves the low-privileged local user - contractors, shared workstations, lab environments - that AC:H does not eliminate. EPSS data is not available in the provided intelligence, so exploitation probability cannot be quantified numerically.
Exploit ScenarioDerived

An attacker with a low-privileged local account on a RHEL system running GNOME initiates a D-Bus operation that triggers gvfsd-admin to create a private socket in a user-writable directory. While the daemon performs its chown() call on the socket path, the attacker repeatedly swaps the path entry with a symbolic link pointing to /etc/pam.d/su; if the race is won, the daemon follows the symlink and transfers ownership of that PAM configuration file to the attacker. The attacker then rewrites the PAM policy to permit passwordless root access via su, achieving full privilege escalation. No public proof-of-concept code has been identified at time of analysis.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 10, 2026

Local privilege escalation in gvfs's privileged gvfsd-admin daemon affects Red Hat Enterprise Linux 6 through 10, allowing an authenticated local attacker to obtain root access. The daemon's use of symlink-following chown() on attacker-controlled directory paths creates a TOCTOU window during D-Bus socket setup. By racing the operation and substituting a symlink to a root-owned file such as /etc/pam.d/su, an attacker causes the daemon to transfer ownership of that critical file to the attacker's UID, enabling subsequent modification and full privilege escalation to root.

RemediationAI

Apply the vendor-provided fix via standard RHEL package management (dnf update gvfs or yum update gvfs) once Red Hat publishes updated packages; monitor https://access.redhat.com/security/cve/CVE-2026-88924 for errata availability. Upstream fix tracking is ongoing at https://gitlab.gnome.org/GNOME/gvfs/-/issues/875 - a patched version is not independently confirmed from available data. As a compensating control prior to patching, disable or remove the GNOME desktop stack and gvfsd-admin on server or headless RHEL systems that do not require a graphical interface, which eliminates the attack surface entirely with no functional trade-off for those systems. On shared GNOME workstations where removal is not viable, restricting interactive local account access to the minimum necessary users limits the pool of potential exploiters. No specific configuration knob to disable the vulnerable chown path within gvfsd-admin has been documented in available references.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

gvfs (GNOME Virtual File System) is a userspace virtual filesystem layer providing filesystem abstraction for GNOME desktop environments. The gvfsd-admin daemon operates with elevated privileges to manage administrative filesystem operations and D-Bus socket lifecycle. The root cause is CWE-367 (Time-of-Check Time-of-Use Race Condition): the daemon calls the symlink-following chown() syscall on a socket pathname within a user-writable directory, without using safer alternatives such as fchown() on an open file descriptor or lchown() which does not traverse symlinks. The race window exists between the daemon verifying the path and executing chown(), during which the attacker replaces the target path with a symlink. Affected CPEs span Red Hat Enterprise Linux 6 through 10 (cpe:2.3:a:red_hat:red_hat_enterprise_linux_6 through cpe:2.3:a:red_hat:red_hat_enterprise_linux_10), indicating this vulnerability has been present across many RHEL major release cycles.

Know when Red Hat Enterprise Linux 10 gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (redhat) PRIMARY 7.0 HIGH
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI 7.0 HIGH

Local access with a race condition (AC:H) required; low-privilege account is sufficient; once the race is won, full system compromise results.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE HIGH
Red Hat 7.0 HIGH

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector
Local
Attack Complexity
High
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

DescriptionCVE.org

A flaw was found in the admin backend of gvfs. The privileged gvfsd-admin daemon changes the ownership of newly created private D-Bus sockets by calling the link-following chown() function on a pathname inside a user-controlled directory. A local attacker can exploit this via a Time-of-Check Time-of-Use (TOCTOU) race condition and exchange the socket pathname with a symbolic link pointing to an arbitrary root-owned file (such as /etc/pam.d/su). The daemon subsequently follows the symlink and changes the ownership of the targeted root-owned file to the attacker's user ID. This allows an authenticated local attacker to modify critical system files, leading to a full local privilege escalation to root.

Executive ViewAI

Why It Matters

A local privilege escalation vulnerability in GNOME Virtual File System (gvfs) on Red Hat Enterprise Linux 6 through 10 allows authenticated local users to escalate to root privileges through a symlink-race condition in the privileged gvfsd-admin daemon. This affects organizations across their RHEL infrastructure, enabling complete system compromise by any local system user. Leadership should prioritize immediate identification of affected systems and implementation of compensating controls pending patch availability.

Business Impact: High
Compensating Controls

No vendor-released patch identified at time of analysis. Implement the following interim mitigations: (1) restrict local shell access (SSH, console) to essential users only and review account provisioning policies, (2) disable gvfsd-admin daemon and gvfs services if not required for business operations, (3) deploy SELinux or AppArmor mandatory access controls to prevent unauthorized symlink operations in system-critical directories including /etc/pam.d, (4) enable comprehensive audit logging for privilege escalation attempts and gvfsd-admin daemon activity, and (5) apply principle of least privilege to all local user accounts, removing unnecessary administrative capabilities.

Threat Intelligence Overview

EPSS Score
0.2%
Top 93% exploitable
Prevalence
Medium
common on RHEL and GNOME-based Linux workstations
Data Quality
7 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.2%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
Poc
System Exposure· derived
Small
Automatable
No
Human Impact
High
Technical Impact
Total

Priority Score

35
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +35
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Privilege Escalation HIGH

Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.

Affected Products (CPE)CVE.org

cpe:2.3:a:red_hat:red_hat_enterprise_linux_10:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_6:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_7:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_8:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_9:*:*:*:*:*:*:*:*

More in Red Hat Enterprise Linux 10

View all
CVE-2026-18663 MEDIUM
5.9 Aug 12

Heap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash
CVE-2026-4631 CRITICAL POC
9.8 Apr 07

Remote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h
CVE-2026-4480 CRITICAL POC
9.0 May 26

Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
CVE-2026-101258 HIGH POC
7.8 Oct 06

Ghostscript can execute arbitrary shell commands with the privileges of its process when it renders a crafted PostScript
CVE-2026-96889 HIGH POC
7.8 Sep 23

Use-after-free in librsvg during rendering of crafted SVG documents with nested XInclude directives and duplicate entity
CVE-2026-4775 HIGH POC
7.8 Mar 24

A signed integer overflow vulnerability exists in the libtiff library's putcontig8bitYCbCr44tile function that leads to

CVE-2026-114406 MEDIUM POC
6.8 Oct 21

The system CA trust store shipped in Red Hat's ca-certificates RPM packages includes eMudhra root authorities that signe
CVE-2026-18922 CRITICAL
9.8 Sep 07

Authentication bypass in 389 Directory Server (shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) lets remo
CVE-2026-14544 CRITICAL
9.8 Jul 03

Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter

CVE-2026-76578 CRITICAL
9.8 Sep 07

Unauthenticated privilege escalation in FreeIPA (Red Hat Identity Management) allows a remote attacker to gain genuine a
CVE-2026-102560 CRITICAL
9.8 Sep 29

A heap buffer overflow exists in libsoup's WebSocket permessage-deflate compression path: when a very large outbound mes
CVE-2026-5121 HIGH
7.5 Mar 30

Remote code execution in libarchive on 32-bit systems allows unauthenticated attackers to execute arbitrary code via spe

Same weakness CWE-367 – Time-of-check Time-of-use (TOCTOU) Race Condition

View all
CVE-2024-30088 HIGH POC
7.0
CVE-2025-22224 CRITICAL
9.3
CVE-2025-38352 HIGH POC
7.8
CVE-2023-35311 HIGH
8.8
CVE-2022-48618 HIGH
7.0
CVE-2023-38146 HIGH POC
8.8
CVE-2025-34027 CRITICAL POC
10.0
CVE-2020-1337 HIGH POC
7.8

Same technique Privilege Escalation

View all
CVE-2024-0012 CRITICAL POC
9.3
CVE-2025-47812 CRITICAL POC
10.0
CVE-2013-0422 CRITICAL POC
9.8
CVE-2013-0632 CRITICAL POC
9.8
CVE-2024-9474 MEDIUM POC
6.9
CVE-2017-5689 CRITICAL POC
9.8
CVE-2021-20021 CRITICAL POC
9.8
CVE-2017-12635 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Module for Desktop Applications 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected
SUSE Linux Enterprise Server 16.0 Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-88924 ADVISORY https://ubuntu.com/security/notices/USN-8845-1 ADVISORY https://vuldb.com/vuln/402108 REF https://access.redhat.com/errata/RHSA-2026:73998 REF https://access.redhat.com/errata/RHSA-2026:74370 REF https://access.redhat.com/errata/RHSA-2026:85939 REF https://access.redhat.com/errata/RHSA-2026:85941 REF https://access.redhat.com/errata/RHSA-2026:85942 REF https://access.redhat.com/errata/RHSA-2026:85944 REF https://access.redhat.com/security/cve/CVE-2026-88924 REF https://bugzilla.redhat.com/show_bug.cgi?id=2531456 REF https://gitlab.gnome.org/GNOME/gvfs/-/issues/875

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy