CVE-2026-88924: Time-of-check Time-of-use (TOCTOU) Race Condition in Red Hat Red Hat Enterprise Linux 10
A flaw was found in the admin backend of gvfs. The privileged gvfsd-admin daemon changes the ownership of newly created private D-Bus sockets by calling the link-following chown() function on a pathname inside a user-controlled directory. A local attacker can exploit this via a Time-of-Check Time-of-Use (TOCTOU) race condition and exchange the socket pathname with a symbolic link pointing to an arbitrary root-owned file (such as /etc/pam.d/su). The daemon subsequently follows the symlink and changes the ownership of the targeted root-owned file to the attacker's user ID. This allows an authenticated local attacker to modify critical system files, leading to a full local privilege escalation to root.
AI Analysis
Technical Summary
This vulnerability involves a Time-of-Check Time-of-Use (TOCTOU) race condition in the gvfsd-admin daemon of Red Hat Enterprise Linux 10. The daemon changes ownership of newly created private D-Bus sockets by calling a link-following chown() on a pathname within a user-controlled directory. A local attacker can exploit this by swapping the socket pathname with a symbolic link pointing to an arbitrary root-owned file (e.g., /etc/pam.d/su). The daemon follows the symlink and changes ownership of the targeted root-owned file to the attacker's user ID, allowing modification of critical system files and resulting in full local privilege escalation to root.
Potential Impact
An authenticated local attacker can gain full root privileges by exploiting this vulnerability. The attacker can modify critical system files owned by root, which compromises system integrity and security. The CVSS v3.1 score is 7.0 (High), reflecting high impact on confidentiality, integrity, and availability.
Mitigation Recommendations
Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-88924 for current remediation guidance. Until a patch is available, restrict local user access and monitor for suspicious activity related to gvfsd-admin. Avoid running untrusted code with local user privileges.
CVE-2026-88924: Time-of-check Time-of-use (TOCTOU) Race Condition in Red Hat Red Hat Enterprise Linux 10
Description
A flaw was found in the admin backend of gvfs. The privileged gvfsd-admin daemon changes the ownership of newly created private D-Bus sockets by calling the link-following chown() function on a pathname inside a user-controlled directory. A local attacker can exploit this via a Time-of-Check Time-of-Use (TOCTOU) race condition and exchange the socket pathname with a symbolic link pointing to an arbitrary root-owned file (such as /etc/pam.d/su). The daemon subsequently follows the symlink and changes the ownership of the targeted root-owned file to the attacker's user ID. This allows an authenticated local attacker to modify critical system files, leading to a full local privilege escalation to root.
CVSS v3.1
Score 7.0high
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability involves a Time-of-Check Time-of-Use (TOCTOU) race condition in the gvfsd-admin daemon of Red Hat Enterprise Linux 10. The daemon changes ownership of newly created private D-Bus sockets by calling a link-following chown() on a pathname within a user-controlled directory. A local attacker can exploit this by swapping the socket pathname with a symbolic link pointing to an arbitrary root-owned file (e.g., /etc/pam.d/su). The daemon follows the symlink and changes ownership of the targeted root-owned file to the attacker's user ID, allowing modification of critical system files and resulting in full local privilege escalation to root.
Potential Impact
An authenticated local attacker can gain full root privileges by exploiting this vulnerability. The attacker can modify critical system files owned by root, which compromises system integrity and security. The CVSS v3.1 score is 7.0 (High), reflecting high impact on confidentiality, integrity, and availability.
Mitigation Recommendations
Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-88924 for current remediation guidance. Until a patch is available, restrict local user access and monitor for suspicious activity related to gvfsd-admin. Avoid running untrusted code with local user privileges.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- redhat
- Date Reserved
- 2026-09-10T14:04:13.603Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
- Vendor Advisory Urls
- [{"url":"https://access.redhat.com/security/cve/CVE-2026-88924","vendor":"Red Hat"}]
Threat ID: 6aa2c26fcc1b963112b5eb87
Added to database: 09/10/2026, 14:45:03 UTC
Last enriched: 09/10/2026, 14:49:19 UTC
Last updated: 09/10/2026, 15:20:30 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.