Reference page — cumulative record through Saturday, October 3, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
CVE-2026-88924
GNOME gvfs — Gvfs: gvfs-admin socket ownership race permits local root
AV AC PR UI S C I A CVSS EPSS %ile KEV
L H L N U H H H 7.0 .0017 6.1 —
AFFECTED
Product Versions Fixed
gvfs 1.48.1 – —
Red Hat Enterprise Linux 10 unspecified 0:1.54.4-4.el10_2.1
Red Hat Enterprise Linux 9 unspecified 0:1.48.1-8.el9_8.1
Red Hat Enterprise Linux 6 unspecified —
Red Hat Enterprise Linux 7 unspecified —
Red Hat Enterprise Linux 8 unspecified —
TIMELINE
Sep 10 Reserved by redhat
Sep 10 Published (CNA: redhat)
Sep 30 PATCH SHIPPED — CVE-2026-88924 (GNOME gvfs). Fixed in Red Hat Enterprise Linux 10 0:1.54.4-4.el10_2.1.
Description
A flaw was found in the admin backend of gvfs. The privileged gvfsd-admin daemon changes the ownership of newly created private D-Bus sockets by calling the link-following chown() function on a pathname inside a user-controlled directory. A local attacker can exploit this via a Time-of-Check Time-of-Use (TOCTOU) race condition and exchange the socket pathname with a symbolic link pointing to an arbitrary root-owned file (such as /etc/pam.d/su). The daemon subsequently follows the symlink and changes the ownership of the targeted root-owned file to the attacker's user ID. This allows an authenticated local attacker to modify critical system files, leading to a full local privilege escalation to root.
Lifecycle
Complete event history — 3 events, chronological
| Date | Event | Detail |
|---|
| September 10, 2026 | Reserved | Reserved by redhat |
| September 10, 2026 | Published | Published (CNA: redhat) |
| September 30, 2026 | PATCH SHIPPED | PATCH SHIPPED — CVE-2026-88924 (GNOME gvfs). Fixed in Red Hat Enterprise Linux 10 0:1.54.4-4.el10_2.1. |
Affected
Affected products and packages — 6 rows
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|
| GNOME | gvfs | — | 1.48.1 | — |
| Red Hat | Red Hat Enterprise Linux 10 | — | — | 0:1.54.4-4.el10_2.1 |
| Red Hat | Red Hat Enterprise Linux 9 | — | — | 0:1.48.1-8.el9_8.1 |
| Red Hat | Red Hat Enterprise Linux 6 | — | — | — |
| Red Hat | Red Hat Enterprise Linux 7 | — | — | — |
| Red Hat | Red Hat Enterprise Linux 8 | — | — | — |
About this page
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-88924 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Saturday, October 3, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.
