CVE-2026-88924

Name of the Vulnerable Software and Affected Versions gvfs versions prior to 1.60.3-1.1

Description A flaw exists in the admin backend of gvfs where the privileged gvfsd-admin daemon changes the ownership of newly created private D-Bus sockets using the link-following chown() function on a pathname within a user-controlled directory. An authenticated local attacker can exploit this through a Time-of-Check Time-of-Use (TOCTOU) race condition—a scenario where a system checks a condition and then uses the result, but the condition changes between the check and the use—by replacing the socket pathname with a symbolic link to an arbitrary root-owned file. This causes the daemon to change the ownership of the targeted file to the attacker's user ID, enabling the modification of critical system files and resulting in full local privilege escalation to root.

Recommendations Update to version 1.60.3-1.1.