Skip to content

CVE-2026-54228

Abrt: toctou race condition in abrt-dbus setelement allows arbitrary file writes to dump directories

7.8 High

A time-of-check time-of-use (TOCTOU) race condition was found in the abrt-dbus D-Bus service's SetElement method. Between dump directory creation and post-create event execution, any local user can call SetElement to write arbitrary text files into the root-owned dump directory, bypassing package validation and allowing crashes of unpackaged binaries to survive post-create processing.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

0.13%Up 0.1 points since Jun 13, 2026

What each source reports

CVE List Score used 7.8

Abrt: toctou race condition in abrt-dbus setelement allows arbitrary file writes to dump directories

A time-of-check time-of-use (TOCTOU) race condition was found in the abrt-dbus D-Bus service's SetElement method. Between dump directory creation and post-create event execution, any local user can call SetElement to write arbitrary text files into the root-owned dump directory, bypassing package validation and allowing crashes of unpackaged binaries to survive post-create processing.

Record: CVE-2026-54228
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-367, CWE-367
Updated: 2026-11-04

EUVDEUVD-2026-36637 7.8

A time-of-check time-of-use (TOCTOU) race condition was found in the abrt-dbus D-Bus service's SetElement method. Between dump directory creation and post-create event execution, any local user can call SetElement to write arbitrary text files into the root-owned dump directory, bypassing package validation and allowing crashes of unpackaged binaries to survive post-create processing.

Record: EUVD-2026-36637
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-05

GitHub AdvisoriesGHSA-6pjg-wmm6-r8rp 7.8

A time-of-check time-of-use (TOCTOU) race condition was found in the abrt-dbus D-Bus service's...

A time-of-check time-of-use (TOCTOU) race condition was found in the abrt-dbus D-Bus service's SetElement method. Between dump directory creation and post-create event execution, any local user can call SetElement to write arbitrary text files into the root-owned dump directory, bypassing package validation and allowing crashes of unpackaged binaries to survive post-create processing.

Record: GHSA-6pjg-wmm6-r8rp
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-367
Updated: 2026-11-02

NVD 7.8

A time-of-check time-of-use (TOCTOU) race condition was found in the abrt-dbus D-Bus service's SetElement method. Between dump directory creation and post-create event execution, any local user can call SetElement to write arbitrary text files into the root-owned dump directory, bypassing package validation and allowing crashes of unpackaged binaries to survive post-create processing.

Record: CVE-2026-54228
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-367
Updated: 2026-11-05

OSVRHSA-2026:48819 7.8

Red Hat Security Advisory: abrt security update

Record: RHSA-2026:48819
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2026:48864 7.8

Red Hat Security Advisory: abrt security update

Record: RHSA-2026:48864
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

Show 5 moreShow less

OSVRHSA-2026:48865 7.8

Red Hat Security Advisory: abrt security update

Record: RHSA-2026:48865
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2026:48866 7.8

Red Hat Security Advisory: abrt security update

Record: RHSA-2026:48866
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2026:54272 7.8

Red Hat Security Advisory: abrt security update

Record: RHSA-2026:54272
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRLSA-2026:54272 7.8

Important: abrt security update

The Automatic Bug Reporting Tool (ABRT) recognizes defects in applications and creates bug reports that help maintainers fix the defects. ABRT uses a plug-in system to extend its functionality.

Security Fix(es):

abrt: TOCTOU race condition in abrt-dbus SetElement allows arbitrary file writes to dump directories (CVE-2026-54228)
abrt: ChownProblemDir succeeds during active post-create event processing due to inadequate locking (CVE-2026-54229)
abrt: event handler scripts follow symlinks when writing output files, allowing arbitrary file overwrites (CVE-2026-54230)
abrt: unsanitized systemd journal content written to dump directory files enables content injection (CVE-2026-54231)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: RLSA-2026:54272
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVALSA-2026:54272 No score

Important: abrt security update

The Automatic Bug Reporting Tool (ABRT) recognizes defects in applications and creates bug reports that help maintainers fix the defects. ABRT uses a plug-in system to extend its functionality.

Security Fix(es):

abrt: TOCTOU race condition in abrt-dbus SetElement allows arbitrary file writes to dump directories (CVE-2026-54228)
abrt: ChownProblemDir succeeds during active post-create event processing due to inadequate locking (CVE-2026-54229)
abrt: event handler scripts follow symlinks when writing output files, allowing arbitrary file overwrites (CVE-2026-54230)
abrt: unsanitized systemd journal content written to dump directory files enables content injection (CVE-2026-54231)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: ALSA-2026:54272
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`abrt` AlmaLinux:8 From an advisory covering 4 CVEs	before 2.10.9-26.el8_10.alma.1	2.10.9-26.el8_10.alma.1
`abrt-addon-ccpp` AlmaLinux:8 From an advisory covering 4 CVEs	before 2.10.9-26.el8_10.alma.1	2.10.9-26.el8_10.alma.1
`abrt-addon-coredump-helper` AlmaLinux:8 From an advisory covering 4 CVEs	before 2.10.9-26.el8_10.alma.1	2.10.9-26.el8_10.alma.1
`abrt-addon-kerneloops` AlmaLinux:8 From an advisory covering 4 CVEs	before 2.10.9-26.el8_10.alma.1	2.10.9-26.el8_10.alma.1
`abrt-addon-pstoreoops` AlmaLinux:8 From an advisory covering 4 CVEs	before 2.10.9-26.el8_10.alma.1	2.10.9-26.el8_10.alma.1
`abrt-addon-vmcore` AlmaLinux:8 From an advisory covering 4 CVEs	before 2.10.9-26.el8_10.alma.1	2.10.9-26.el8_10.alma.1
`abrt-addon-xorg` AlmaLinux:8 From an advisory covering 4 CVEs	before 2.10.9-26.el8_10.alma.1	2.10.9-26.el8_10.alma.1
`abrt-cli` AlmaLinux:8 From an advisory covering 4 CVEs	before 2.10.9-26.el8_10.alma.1	2.10.9-26.el8_10.alma.1
`abrt-cli-ng` AlmaLinux:8 From an advisory covering 4 CVEs	before 2.10.9-26.el8_10.alma.1	2.10.9-26.el8_10.alma.1
`abrt-console-notification` AlmaLinux:8 From an advisory covering 4 CVEs	before 2.10.9-26.el8_10.alma.1	2.10.9-26.el8_10.alma.1

Show 58 moreShow less

Affected packages
Package	Affected	Fixed
`abrt-dbus` AlmaLinux:8 From an advisory covering 4 CVEs	before 2.10.9-26.el8_10.alma.1	2.10.9-26.el8_10.alma.1
`abrt-desktop` AlmaLinux:8 From an advisory covering 4 CVEs	before 2.10.9-26.el8_10.alma.1	2.10.9-26.el8_10.alma.1
`abrt-gui` AlmaLinux:8 From an advisory covering 4 CVEs	before 2.10.9-26.el8_10.alma.1	2.10.9-26.el8_10.alma.1
`abrt-gui-libs` AlmaLinux:8 From an advisory covering 4 CVEs	before 2.10.9-26.el8_10.alma.1	2.10.9-26.el8_10.alma.1
`abrt-libs` AlmaLinux:8 From an advisory covering 4 CVEs	before 2.10.9-26.el8_10.alma.1	2.10.9-26.el8_10.alma.1
`abrt-plugin-machine-id` AlmaLinux:8 From an advisory covering 4 CVEs	before 2.10.9-26.el8_10.alma.1	2.10.9-26.el8_10.alma.1
`abrt-plugin-sosreport` AlmaLinux:8 From an advisory covering 4 CVEs	before 2.10.9-26.el8_10.alma.1	2.10.9-26.el8_10.alma.1
`abrt-tui` AlmaLinux:8 From an advisory covering 4 CVEs	before 2.10.9-26.el8_10.alma.1	2.10.9-26.el8_10.alma.1
`python3-abrt` AlmaLinux:8 From an advisory covering 4 CVEs	before 2.10.9-26.el8_10.alma.1	2.10.9-26.el8_10.alma.1
`python3-abrt-addon` AlmaLinux:8 From an advisory covering 4 CVEs	before 2.10.9-26.el8_10.alma.1	2.10.9-26.el8_10.alma.1
`python3-abrt-container-addon` AlmaLinux:8 From an advisory covering 4 CVEs	before 2.10.9-26.el8_10.alma.1	2.10.9-26.el8_10.alma.1
`python3-abrt-doc` AlmaLinux:8 From an advisory covering 4 CVEs	before 2.10.9-26.el8_10.alma.1	2.10.9-26.el8_10.alma.1
`abrt-dbus` Red Hat:rhel_aus:8.6::appstream From an advisory covering 2 CVEs	before 0:2.10.9-25.el8_6.1	0:2.10.9-25.el8_6.1
`abrt-dbus` Red Hat:rhel_eus_long_life:8.6::appstream From an advisory covering 2 CVEs	before 0:2.10.9-25.el8_6.1	0:2.10.9-25.el8_6.1
`abrt-dbus` Red Hat:rhel_e4s:8.8::appstream From an advisory covering 2 CVEs	before 0:2.10.9-25.el8_8.1	0:2.10.9-25.el8_8.1
`abrt-dbus` Red Hat:rhel_tus:8.8::appstream From an advisory covering 2 CVEs	before 0:2.10.9-25.el8_8.1	0:2.10.9-25.el8_8.1
`abrt-dbus` Red Hat:rhel_aus:8.4::appstream From an advisory covering 2 CVEs	before 0:2.10.9-25.el8_4.1	0:2.10.9-25.el8_4.1
`abrt-dbus` Red Hat:rhel_eus_long_life:8.4::appstream From an advisory covering 2 CVEs	before 0:2.10.9-25.el8_4.1	0:2.10.9-25.el8_4.1
`abrt-dbus` Red Hat:rhel_els:7 From an advisory covering 2 CVEs	before 0:2.1.11-61.el7_9	0:2.1.11-61.el7_9
`abrt` Red Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs	before 0:2.10.9-26.el8_10	0:2.10.9-26.el8_10
`abrt-addon-ccpp` Red Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs	before 0:2.10.9-26.el8_10	0:2.10.9-26.el8_10
`abrt-addon-ccpp-debuginfo` Red Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs	before 0:2.10.9-26.el8_10	0:2.10.9-26.el8_10
`abrt-addon-coredump-helper` Red Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs	before 0:2.10.9-26.el8_10	0:2.10.9-26.el8_10
`abrt-addon-coredump-helper-debuginfo` Red Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs	before 0:2.10.9-26.el8_10	0:2.10.9-26.el8_10
`abrt-addon-kerneloops` Red Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs	before 0:2.10.9-26.el8_10	0:2.10.9-26.el8_10
`abrt-addon-kerneloops-debuginfo` Red Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs	before 0:2.10.9-26.el8_10	0:2.10.9-26.el8_10
`abrt-addon-pstoreoops` Red Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs	before 0:2.10.9-26.el8_10	0:2.10.9-26.el8_10
`abrt-addon-pstoreoops-debuginfo` Red Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs	before 0:2.10.9-26.el8_10	0:2.10.9-26.el8_10
`abrt-addon-upload-watch-debuginfo` Red Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs	before 0:2.10.9-26.el8_10	0:2.10.9-26.el8_10
`abrt-addon-vmcore` Red Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs	before 0:2.10.9-26.el8_10	0:2.10.9-26.el8_10
`abrt-addon-xorg` Red Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs	before 0:2.10.9-26.el8_10	0:2.10.9-26.el8_10
`abrt-addon-xorg-debuginfo` Red Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs	before 0:2.10.9-26.el8_10	0:2.10.9-26.el8_10
`abrt-atomic-debuginfo` Red Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs	before 0:2.10.9-26.el8_10	0:2.10.9-26.el8_10
`abrt-cli` Red Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs	before 0:2.10.9-26.el8_10	0:2.10.9-26.el8_10
`abrt-cli-ng` Red Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs	before 0:2.10.9-26.el8_10	0:2.10.9-26.el8_10
`abrt-console-notification` Red Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs	before 0:2.10.9-26.el8_10	0:2.10.9-26.el8_10
`abrt-dbus` Red Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs	before 0:2.10.9-26.el8_10	0:2.10.9-26.el8_10
`abrt-dbus-debuginfo` Red Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs	before 0:2.10.9-26.el8_10	0:2.10.9-26.el8_10
`abrt-debuginfo` Red Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs	before 0:2.10.9-26.el8_10	0:2.10.9-26.el8_10
`abrt-debugsource` Red Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs	before 0:2.10.9-26.el8_10	0:2.10.9-26.el8_10
`abrt-desktop` Red Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs	before 0:2.10.9-26.el8_10	0:2.10.9-26.el8_10
`abrt-gui` Red Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs	before 0:2.10.9-26.el8_10	0:2.10.9-26.el8_10
`abrt-gui-debuginfo` Red Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs	before 0:2.10.9-26.el8_10	0:2.10.9-26.el8_10
`abrt-gui-libs` Red Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs	before 0:2.10.9-26.el8_10	0:2.10.9-26.el8_10
`abrt-gui-libs-debuginfo` Red Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs	before 0:2.10.9-26.el8_10	0:2.10.9-26.el8_10
`abrt-libs` Red Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs	before 0:2.10.9-26.el8_10	0:2.10.9-26.el8_10
`abrt-libs-debuginfo` Red Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs	before 0:2.10.9-26.el8_10	0:2.10.9-26.el8_10
`abrt-plugin-machine-id` Red Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs	before 0:2.10.9-26.el8_10	0:2.10.9-26.el8_10
`abrt-plugin-sosreport` Red Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs	before 0:2.10.9-26.el8_10	0:2.10.9-26.el8_10
`abrt-retrace-client-debuginfo` Red Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs	before 0:2.10.9-26.el8_10	0:2.10.9-26.el8_10
`abrt-tui` Red Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs	before 0:2.10.9-26.el8_10	0:2.10.9-26.el8_10
`abrt-tui-debuginfo` Red Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs	before 0:2.10.9-26.el8_10	0:2.10.9-26.el8_10
`python3-abrt` Red Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs	before 0:2.10.9-26.el8_10	0:2.10.9-26.el8_10
`python3-abrt-addon` Red Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs	before 0:2.10.9-26.el8_10	0:2.10.9-26.el8_10
`python3-abrt-container-addon` Red Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs	before 0:2.10.9-26.el8_10	0:2.10.9-26.el8_10
`python3-abrt-debuginfo` Red Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs	before 0:2.10.9-26.el8_10	0:2.10.9-26.el8_10
`python3-abrt-doc` Red Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs	before 0:2.10.9-26.el8_10	0:2.10.9-26.el8_10
`abrt` Rocky Linux:8 From an advisory covering 4 CVEs	before 0:2.10.9-26.el8_10.rocky.0.1	0:2.10.9-26.el8_10.rocky.0.1

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts	EUVD, NVD
Nov 4, 2026	facts	CVE List
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-54228 is a high vulnerability (CVSS 7.8) in Red Hat Enterprise Linux 6, published June 13, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.13%, the 2nd percentile. No source names a fixed version.

References

Show 29 moreShow less