This vulnerability involves a race condition in the abrt-dbus D-Bus service's ChownProblemDir method. The method opens the dump directory with read-only flags and changes ownership of all files to the caller's user ID, succeeding even while post-create event handlers hold a write lock. This improper synchronization allows an attacker to gain control over the dump directory at the filesystem level during active privileged event script execution. The issue is tracked as CVE-2026-54229 and affects Red Hat Enterprise Linux 7 Extended Lifecycle Support. Red Hat has published an advisory and issued a security update to fix this vulnerability.

An attacker with local privileges can exploit this race condition to gain filesystem-level control over the dump directory while privileged event scripts are running. This could lead to unauthorized file ownership changes and potentially escalate privileges or interfere with system operations. The CVSS 3.1 base score is 7.0, indicating high impact on confidentiality, integrity, and availability.

Red Hat has released a security update that fixes this race condition vulnerability. Users of Red Hat Enterprise Linux 7 Extended Lifecycle Support should apply the official patch provided by Red Hat as detailed in their security advisory (https://access.redhat.com/security/cve/CVE-2026-54229). No alternative mitigations are specified, so applying the vendor's update is the recommended course of action.