CVE-2026-88924: Gvfs: gvfs admin socket ownership race permits local root
A flaw was found in the admin backend of gvfs. The privileged gvfsd-admin daemon changes the ownership of newly created private D-Bus sockets by calling the link-following chown() function on a pathname inside a user-controlled directory. A local attacker can exploit this via a Time-of-Check Time-of-Use (TOCTOU) race condition and exchange the socket pathname with a symbolic link pointing to an arbitrary root-owned file (such as /etc/pam.d/su). The daemon subsequently follows the symlink and changes the ownership of the targeted root-owned file to the attacker's user ID. This allows an authenticated local attacker to modify critical system files, leading to a full local privilege escalation to root.
Other sources
A flaw was found in the admin backend of gvfs. The privileged gvfsd-admin daemon changes the ownership of newly created private D-Bus sockets by calling the link-following chown() function on a pathname inside a user-controlled directory. A local attacker can exploit this via a Time-of-Check Time-of-Use (TOCTOU) race condition by using inotify to detect the socket creation, and then atomically exchanging the socket pathname with a symbolic link pointing to an arbitrary root-owned file (such as /etc/pam.d/su). The daemon subsequently follows the symlink and changes the ownership of the targeted root-owned file to the attacker's user ID. This allows an authenticated local attacker to modify critical system files, leading to a full local privilege escalation to root. This vulnerability affects gvfs versions 1.48.1 and newer.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems running the privileged gvfsd-admin daemon are exposed to authenticated local attackers. The attacker needs a local user account; no user interaction is required.
What does an attacker need to do to exploit it?
The attacker must win a TOCTOU race in a user-controlled directory, replacing a newly created private D-Bus socket pathname with a symbolic link to a root-owned target file. The description notes that inotify can be used to detect socket creation before performing the atomic exchange.
What is the impact if exploitation succeeds?
The daemon can be made to change ownership of an arbitrary root-owned file to the attacker's user ID. The attacker can then modify critical files, such as /etc/pam.d/su, to obtain root privileges.