Bug 2531456 (CVE-2026-88924)

A flaw was found in the admin backend of gvfs. The privileged gvfsd-admin daemon changes the ownership of newly created private D-Bus sockets by calling the link-following chown() function on a pathname inside a user-controlled directory. A local attacker can exploit this via a Time-of-Check Time-of-Use (TOCTOU) race condition by using inotify to detect the socket creation, and then atomically exchanging the socket pathname with a symbolic link pointing to an arbitrary root-owned file (such as /etc/pam.d/su). The daemon subsequently follows the symlink and changes the ownership of the targeted root-owned file to the attacker's user ID. This allows an authenticated local attacker to modify critical system files, leading to a full local privilege escalation to root. This vulnerability affects gvfs versions 1.48.1 before 1.58.5, versions 1.48.1 before 1.60.3 and versions 1.48.1 before 1.62.0.