CVE-2026-54228 is a TOCTOU race condition in the abrt-dbus D-Bus service's SetElement method. The race occurs between the creation of a dump directory and the execution of a post-create event, allowing local users to write arbitrary files into a root-owned dump directory. This bypasses package validation and permits crashes of unpackaged binaries to survive post-create processing. The vulnerability affects Red Hat Enterprise Linux 7 Extended Lifecycle Support and 8.x Update Services for SAP Solutions and Telecommunications Update Service versions. Red Hat has issued security advisories and updates to fix this issue by correcting locking and validation mechanisms in the abrt packages.

The vulnerability allows a local user with limited privileges to write arbitrary files into a root-owned dump directory, bypassing package validation. This can lead to unauthorized file writes and potentially allow crashes of unpackaged binaries to survive processing, which may impact system integrity and reliability. The CVSS 3.1 base score of 7.8 indicates high impact on confidentiality, integrity, and availability.

Red Hat has released official security updates that fix this vulnerability. Users should apply the abrt package updates provided in Red Hat advisories RHSA-2026:48864 and RHSA-2026:48819 as soon as possible. The vendor advisory provides detailed instructions for applying these updates. No additional mitigations are required once the update is applied.