CVE-2026-54229 is a race condition vulnerability in the Automatic Bug Reporting Tool (ABRT) abrt-dbus service's ChownProblemDir method. The method opens the dump directory with read-only flags and changes ownership of all files to the caller's user ID, succeeding even while post-create event handlers hold a write lock. This improper synchronization allows an attacker with local access and low privileges to gain control over the dump directory during active event processing. The vulnerability affects Red Hat Enterprise Linux 7 Extended Lifecycle Support (versions >=7.0 <8.0) and RHEL 8 (versions >=8.0 <=8.6) where ABRT is installed. Red Hat has issued security advisories and patches to fix this race condition and recommends disabling or removing ABRT on RHEL 8 systems. The CVSS v3.1 score is 7.0 (High severity) with impact on confidentiality, integrity, and availability.

An attacker with local access and low privileges can exploit this race condition to gain filesystem-level control over the dump directory used by ABRT. This can lead to unauthorized file ownership changes while privileged event scripts are running, potentially allowing execution of unauthorized code or commands, privilege escalation, and disruption of system stability. The vulnerability impacts confidentiality, integrity, and availability of affected systems.

Red Hat has released security updates that fix this vulnerability. Users should apply the available patches for ABRT as provided in the Red Hat advisory RHSA-2026:48819. On RHEL 8 systems where ABRT is installed, it is recommended to disable or remove ABRT if it is not required using systemctl commands to stop and disable the related services. Fedora users should consider using systemd-coredump instead of ABRT. Additionally, restricting local user access to systems running ABRT reduces exposure since exploitation requires local access.