A flaw was found in abrt. The fix for CVE-2026-54228 and CVE-2026-54229 gates SetElement, DeleteElement, and ChownProblemDir on problem_dump_dir_is_complete(), which is implemented solely as the presence of a "count" dump element. An unprivileged caller can supply "count" via NewProblem or SetElement, so the directory appears complete from creation and the guard passes while root post-create/notify handlers are still processing the dump. Separately, the Problems2 SaveElements/DeleteElements methods and DeleteProblem lack the completeness guard. A local attacker can thereby re-open the original element-poisoning and dump-directory ownership-seizure primitives.