Read the docs
TI-2026-60294 Aliases CVE-2026-88924GHSA-8w8m-36rw-gg63

Gvfs: gvfs-admin socket ownership race permits local root

Priority HIGH 66CWE-367Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 8 fixed, 2 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat.

Summary

A flaw was found in the admin backend of gvfs. The privileged gvfsd-admin daemon changes the ownership of newly created private D-Bus sockets by calling the link-following chown() function on a pathname inside a user-controlled directory. A local attacker can exploit this via a Time-of-Check Time-of-Use (TOCTOU) race condition and exchange the socket pathname with a symbolic link pointing to an arbitrary root-owned file (such as /etc/pam.d/su). The daemon subsequently follows the symlink and changes the ownership of the targeted root-owned file to the attacker's user ID. This allows an authenticated local attacker to modify critical system files, leading to a full local privilege escalation to root.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00223 12th percentileScored 2026-11-07
Fix Partial gvfs (GNOME): 1.62.0, 1.60.3, 1.58.5Red Hat: 6 advisoriesRed Hat: 8 fixed, 2 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
GNOMEgvfs1.48.1 to before 1.62.0; 1.48.1 to before 1.60.3; 1.48.1 to before 1.58.51.62.0, 1.60.3, 1.58.5Patch availableCNA
Red HatRed Hat Enterprise Linux 10—1.54.4-4.el10_2.1Patch availableCNA
Red HatRed Hat Enterprise Linux 10.0 Extended Update Support—1.54.4-2.el10_0.2Patch availableCNA
Red HatRed Hat Enterprise Linux 9—1.48.1-8.el9_8.1Patch availableCNA
Red HatRed Hat Enterprise Linux 9.2 Update Services for SAP Solutions—1.48.1-4.el9_2.1Patch availableCNA
Red HatRed Hat Enterprise Linux 9.4 Update Services for SAP Solutions—1.48.1-4.el9_4.1Patch availableCNA
Red HatRed Hat Enterprise Linux 9.6 Extended Update Support—1.48.1-6.el9_6.1Patch availableCNA
Red HatRed Hat Enterprise Linux 6——No fix listedCNA
Red HatRed Hat Enterprise Linux 7——No fix listedCNA
Red HatRed Hat Enterprise Linux 8——Not affectedCNA
  • gvfs VendorGNOME Affected 1.48.1 to before 1.62.0; 1.48.1 to before 1.60.3; 1.48.1 to before 1.58.5 Fixed in 1.62.0, 1.60.3, 1.58.5 Patch available CNA
  • Red Hat Enterprise Linux 10 VendorRed Hat Affected — Fixed in 1.54.4-4.el10_2.1 Patch available CNA
  • Red Hat Enterprise Linux 10.0 Extended Update Support VendorRed Hat Affected — Fixed in 1.54.4-2.el10_0.2 Patch available CNA
  • Red Hat Enterprise Linux 9 VendorRed Hat Affected — Fixed in 1.48.1-8.el9_8.1 Patch available CNA
  • Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions VendorRed Hat Affected — Fixed in 1.48.1-4.el9_2.1 Patch available CNA
  • Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions VendorRed Hat Affected — Fixed in 1.48.1-4.el9_4.1 Patch available CNA
  • Red Hat Enterprise Linux 9.6 Extended Update Support VendorRed Hat Affected — Fixed in 1.48.1-6.el9_6.1 Patch available CNA
  • Red Hat Enterprise Linux 6 VendorRed Hat Affected — Fixed in — No fix listed CNA
  • Red Hat Enterprise Linux 7 VendorRed Hat Affected — Fixed in — No fix listed CNA
  • Red Hat Enterprise Linux 8 VendorRed Hat Affected — Fixed in — Not affected CNA

CPE names CNA · 11

CPEVersionsRoleVendor
cpe:/o:redhat:enterprise_linux:10.210.2—Red Hat
cpe:/o:redhat:enterprise_linux_eus:10.010.0—Red Hat
cpe:/a:redhat:enterprise_linux:9::appstream9—Red Hat
cpe:/a:redhat:enterprise_linux:9::crb9—Red Hat
cpe:/a:redhat:rhel_e4s:9.2::appstream9.2—Red Hat
cpe:/a:redhat:rhel_e4s:9.4::appstream9.4—Red Hat
cpe:/a:redhat:rhel_eus:9.6::appstream9.6—Red Hat
cpe:/a:redhat:rhel_eus:9.6::crb9.6—Red Hat
cpe:/o:redhat:rhel_els:66—Red Hat
cpe:/o:redhat:rhel_els:77—Red Hat
  • cpe:/o:redhat:enterprise_linux:10.2 Versions 10.2 — ·Red Hat
  • cpe:/o:redhat:enterprise_linux_eus:10.0 Versions 10.0 — ·Red Hat
  • cpe:/a:redhat:enterprise_linux:9::appstream Versions 9 — ·Red Hat
  • cpe:/a:redhat:enterprise_linux:9::crb Versions 9 — ·Red Hat
  • cpe:/a:redhat:rhel_e4s:9.2::appstream Versions 9.2 — ·Red Hat
  • cpe:/a:redhat:rhel_e4s:9.4::appstream Versions 9.4 — ·Red Hat
  • cpe:/a:redhat:rhel_eus:9.6::appstream Versions 9.6 — ·Red Hat
  • cpe:/a:redhat:rhel_eus:9.6::crb Versions 9.6 — ·Red Hat
  • cpe:/o:redhat:rhel_els:6 Versions 6 — ·Red Hat
  • cpe:/o:redhat:rhel_els:7 Versions 7 — ·Red Hat
Show 1 more CPE
CPEVersionsRoleVendor
cpe:/a:redhat:enterprise_linux:88—Red Hat
  • cpe:/a:redhat:enterprise_linux:8 Versions 8 — ·Red Hat

Remediation

  • Fix · CNA gvfs (GNOME) Fixed in 1.62.0, 1.60.3, 1.58.5

Red Hat 6 advisories

  • RHSA-2026:85939 Released 2026-10-20 · Red Hat rating Important
    gvfs security update
    • Red Hat CodeReady Linux Builder EUS (v.9.6) gvfs-1.48.1-6.el9_6.1
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) gvfs-1.48.1-6.el9_6.1, gvfs-client-1.48.1-6.el9_6.1, gvfs-devel-1.48.1-6.el9_6.1 +5
  • RHSA-2026:85944 Released 2026-10-20 · Red Hat rating Important
    gvfs security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.4) gvfs-1.48.1-4.el9_4.1, gvfs-client-1.48.1-4.el9_4.1, gvfs-devel-1.48.1-4.el9_4.1 +5
  • RHSA-2026:85941 Released 2026-10-20 · Red Hat rating Important
    gvfs security update
    • Red Hat Enterprise Linux AppStream EUS (v. 10.0) gvfs-1.54.4-2.el10_0.2, gvfs-client-1.54.4-2.el10_0.2, gvfs-fuse-1.54.4-2.el10_0.2 +4
Show 3 more Red Hat advisories
  • RHSA-2026:85942 Released 2026-10-20 · Red Hat rating Important
    gvfs security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.2) gvfs-1.48.1-4.el9_2.1, gvfs-client-1.48.1-4.el9_2.1, gvfs-devel-1.48.1-4.el9_2.1 +5
  • RHSA-2026:74370 Released 2026-10-01 · Red Hat rating Important
    gvfs security update
    • Red Hat Enterprise Linux AppStream (v. 9) gvfs-1.48.1-8.el9_8.1, gvfs-client-1.48.1-8.el9_8.1, gvfs-devel-1.48.1-8.el9_8.1 +5
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) gvfs-1.48.1-8.el9_8.1
  • RHSA-2026:73998 Released 2026-09-30 · Red Hat rating Important
    gvfs security update
    • Red Hat Enterprise Linux AppStream (v. 10) gvfs-1.54.4-4.el10_2.1, gvfs-client-1.54.4-4.el10_2.1, gvfs-fuse-1.54.4-4.el10_2.1 +4

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 6AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux 7AffectedNo fix planned: Will not fix
Red Hat CodeReady Linux Builder EUS (v.9.6)Fixed RHSA-2026:85939
Red Hat Enterprise Linux AppStream (v. 10)Fixed RHSA-2026:73998
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2026:74370
Red Hat Enterprise Linux AppStream E4S (v.9.2)Fixed RHSA-2026:85942
Red Hat Enterprise Linux AppStream E4S (v.9.4)Fixed RHSA-2026:85944
Red Hat Enterprise Linux AppStream EUS (v. 10.0)Fixed RHSA-2026:85941
Red Hat Enterprise Linux AppStream EUS (v.9.6)Fixed RHSA-2026:85939
Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)Fixed RHSA-2026:74370
Not affected: 1 product
  • Red Hat Enterprise Linux 8

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-88924
  2. 2026-10-03 Alias added: GHSA-8w8m-36rw-gg63
  3. 2026-10-14 Affected versions changed · CNA
  4. 2026-10-15 Affected versions changed · Red Hat
  5. 2026-10-16 Affected versions changed · Red Hat
  6. 2026-10-20 Fix available: gvfs@0:1.48.1-4.el9_2.1, gvfs@0:1.48.1-4.el9_4.1, gvfs@0:1.54.4-2.el10_0.2 · CNA
  7. 2026-10-20 3 new references · CNA
  8. 2026-10-20 Fix available: RHSA-2026:85941 · Red Hat
  9. 2026-10-20 Fix available: RHSA-2026:85942 · Red Hat
  10. 2026-10-20 Fix available: RHSA-2026:85944 · Red Hat
  11. 2026-10-21 Fix available: gvfs@0:1.48.1-6.el9_6.1 · CNA
  12. 2026-10-21 1 new reference · CNA
  13. 2026-10-21 Fix available: RHSA-2026:85939 · Red Hat
  14. 2026-10-21 Fix available: Red Hat CodeReady Linux Builder EUS (v.9.6), Red Hat Enterprise Linux AppStream E4S (v.9.2), Red Hat Enterprise Linux AppStream E4S (v.9.4) +2 · Red Hat

References

Advisory 6

Other 3

  • TI-2023-23091 Gnome-maps: gnome maps is vulnerable to a code injection attack (similar to xss) via its service.json CVSS 3.1CRITICAL 9.8
  • TI-2026-41775 Glib: off-by-one error in glib/gkeyfile.c via "g_key_file_get_locale_string_list" CVSS 3.1HIGH 8.6
  • TI-2026-41772 Glib: out-of-bounds read in glib/gdatetime.c:g_date_time_get_ymd via invalid gdatetime CVSS 3.1HIGH 7.5
  • TI-2026-03716 Libsoup: libsoup: denial of service via use-after-free in http/2 server CVSS 3.1HIGH 7.5
  • TI-2024-28393 Integer overflow in GNOME G Structured File Library CVSS 3.1HIGH 8.4
  • TI-2024-24253 Integer overflow in GNOME G Structured File Library CVSS 3.1HIGH 8.4
See all 402 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences