CVE-2026-88924

gvfs, the GNOME virtual filesystem layer, contains a Time-of-Check Time-of-Use (TOCTOU) flaw in its privileged gvfsd-admin daemon, which follows links when changing ownership of the private D-Bus sockets it creates in a user-controlled directory. An authenticated local attacker can win a race and swap the socket path for a symlink to an arbitrary root-owned file, such as /etc/pam.d/su, causing the daemon to chown that file to the attacker's user ID. By corrupting ownership of critical system files, the attacker achieves full local privilege escalation to root. Any system shipping the vulnerable gvfs admin backend is affected, most notably GNOME-based Linux distributions. No public proof-of-concept or in-the-wild exploitation has been reported; the issue was coordinated by Red Hat as the assigning CNA.

What to do: Install gvfs security updates from your distribution as soon as they are published (no fixed version number is provided in this data, so follow your vendor's advisory for the corrected package version). Confirm exposure by checking whether gvfs is installed (e.g., 'rpm -q gvfs' or 'dpkg -s gvfs') and consider restricting untrusted local shell users until systems are patched. Because the flaw requires local authenticated access and a hard-to-win race (CVSS AC:H), prioritize it alongside other local-privilege-escalation updates rather than as an emergency.