Skip to content

CVE-2026-54229

Abrt: chownproblemdir succeeds during active post-create event processing due to inadequate locking

7.0 High

A race condition was found in the abrt-dbus D-Bus service's ChownProblemDir method. ChownProblemDir opens the dump directory with DD_OPEN_READONLY and calls dd_chown to change ownership of all files to the caller's uid, succeeding even while post-create event handlers hold a write lock. This allows an attacker to gain filesystem-level control of the dump directory while privileged event scripts are still running.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: High
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

0.12%Up 0.1 points since Jun 13, 2026

What each source reports

CVE List Score used 7.0

Abrt: chownproblemdir succeeds during active post-create event processing due to inadequate locking

A race condition was found in the abrt-dbus D-Bus service's ChownProblemDir method. ChownProblemDir opens the dump directory with DD_OPEN_READONLY and calls dd_chown to change ownership of all files to the caller's uid, succeeding even while post-create event handlers hold a write lock. This allows an attacker to gain filesystem-level control of the dump directory while privileged event scripts are still running.

Record: CVE-2026-54229
CVSS 3.1: 7.0 HighCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-362, CWE-362
Updated: 2026-11-04

EUVDEUVD-2026-36638 7.0

A race condition was found in the abrt-dbus D-Bus service's ChownProblemDir method. ChownProblemDir opens the dump directory with DD_OPEN_READONLY and calls dd_chown to change ownership of all files to the caller's uid, succeeding even while post-create event handlers hold a write lock. This allows an attacker to gain filesystem-level control of the dump directory while privileged event scripts are still running.

Record: EUVD-2026-36638
CVSS 3.1: 7.0 HighCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-05

GitHub AdvisoriesGHSA-c3cq-8jxp-w66j 7.0

A race condition was found in the abrt-dbus D-Bus service's ChownProblemDir method....

A race condition was found in the abrt-dbus D-Bus service's ChownProblemDir method. ChownProblemDir opens the dump directory with DD_OPEN_READONLY and calls dd_chown to change ownership of all files to the caller's uid, succeeding even while post-create event handlers hold a write lock. This allows an attacker to gain filesystem-level control of the dump directory while privileged event scripts are still running.

Record: GHSA-c3cq-8jxp-w66j
CVSS 3.1: 7.0 HighCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-362
Updated: 2026-11-02

NVD 7.0

A race condition was found in the abrt-dbus D-Bus service's ChownProblemDir method. ChownProblemDir opens the dump directory with DD_OPEN_READONLY and calls dd_chown to change ownership of all files to the caller's uid, succeeding even while post-create event handlers hold a write lock. This allows an attacker to gain filesystem-level control of the dump directory while privileged event scripts are still running.

Record: CVE-2026-54229
CVSS 3.1: 7.0 HighCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-362
Updated: 2026-11-05

OSVRHSA-2026:48819 7.8

Red Hat Security Advisory: abrt security update

Record: RHSA-2026:48819
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2026:48864 7.8

Red Hat Security Advisory: abrt security update

Record: RHSA-2026:48864
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

Show 5 moreShow less

OSVRHSA-2026:48865 7.8

Red Hat Security Advisory: abrt security update

Record: RHSA-2026:48865
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2026:48866 7.8

Red Hat Security Advisory: abrt security update

Record: RHSA-2026:48866
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2026:54272 7.8

Red Hat Security Advisory: abrt security update

Record: RHSA-2026:54272
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRLSA-2026:54272 7.8

Important: abrt security update

The Automatic Bug Reporting Tool (ABRT) recognizes defects in applications and creates bug reports that help maintainers fix the defects. ABRT uses a plug-in system to extend its functionality.

Security Fix(es):

abrt: TOCTOU race condition in abrt-dbus SetElement allows arbitrary file writes to dump directories (CVE-2026-54228)
abrt: ChownProblemDir succeeds during active post-create event processing due to inadequate locking (CVE-2026-54229)
abrt: event handler scripts follow symlinks when writing output files, allowing arbitrary file overwrites (CVE-2026-54230)
abrt: unsanitized systemd journal content written to dump directory files enables content injection (CVE-2026-54231)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: RLSA-2026:54272
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVALSA-2026:54272 No score

Important: abrt security update

The Automatic Bug Reporting Tool (ABRT) recognizes defects in applications and creates bug reports that help maintainers fix the defects. ABRT uses a plug-in system to extend its functionality.

Security Fix(es):

abrt: TOCTOU race condition in abrt-dbus SetElement allows arbitrary file writes to dump directories (CVE-2026-54228)
abrt: ChownProblemDir succeeds during active post-create event processing due to inadequate locking (CVE-2026-54229)
abrt: event handler scripts follow symlinks when writing output files, allowing arbitrary file overwrites (CVE-2026-54230)
abrt: unsanitized systemd journal content written to dump directory files enables content injection (CVE-2026-54231)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: ALSA-2026:54272
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`abrt` AlmaLinux:8 From an advisory covering 4 CVEs	before 2.10.9-26.el8_10.alma.1	2.10.9-26.el8_10.alma.1
`abrt-addon-ccpp` AlmaLinux:8 From an advisory covering 4 CVEs	before 2.10.9-26.el8_10.alma.1	2.10.9-26.el8_10.alma.1
`abrt-addon-coredump-helper` AlmaLinux:8 From an advisory covering 4 CVEs	before 2.10.9-26.el8_10.alma.1	2.10.9-26.el8_10.alma.1
`abrt-addon-kerneloops` AlmaLinux:8 From an advisory covering 4 CVEs	before 2.10.9-26.el8_10.alma.1	2.10.9-26.el8_10.alma.1
`abrt-addon-pstoreoops` AlmaLinux:8 From an advisory covering 4 CVEs	before 2.10.9-26.el8_10.alma.1	2.10.9-26.el8_10.alma.1
`abrt-addon-vmcore` AlmaLinux:8 From an advisory covering 4 CVEs	before 2.10.9-26.el8_10.alma.1	2.10.9-26.el8_10.alma.1
`abrt-addon-xorg` AlmaLinux:8 From an advisory covering 4 CVEs	before 2.10.9-26.el8_10.alma.1	2.10.9-26.el8_10.alma.1
`abrt-cli` AlmaLinux:8 From an advisory covering 4 CVEs	before 2.10.9-26.el8_10.alma.1	2.10.9-26.el8_10.alma.1
`abrt-cli-ng` AlmaLinux:8 From an advisory covering 4 CVEs	before 2.10.9-26.el8_10.alma.1	2.10.9-26.el8_10.alma.1
`abrt-console-notification` AlmaLinux:8 From an advisory covering 4 CVEs	before 2.10.9-26.el8_10.alma.1	2.10.9-26.el8_10.alma.1

Show 58 moreShow less

Affected packages
Package	Affected	Fixed
`abrt-dbus` AlmaLinux:8 From an advisory covering 4 CVEs	before 2.10.9-26.el8_10.alma.1	2.10.9-26.el8_10.alma.1
`abrt-desktop` AlmaLinux:8 From an advisory covering 4 CVEs	before 2.10.9-26.el8_10.alma.1	2.10.9-26.el8_10.alma.1
`abrt-gui` AlmaLinux:8 From an advisory covering 4 CVEs	before 2.10.9-26.el8_10.alma.1	2.10.9-26.el8_10.alma.1
`abrt-gui-libs` AlmaLinux:8 From an advisory covering 4 CVEs	before 2.10.9-26.el8_10.alma.1	2.10.9-26.el8_10.alma.1
`abrt-libs` AlmaLinux:8 From an advisory covering 4 CVEs	before 2.10.9-26.el8_10.alma.1	2.10.9-26.el8_10.alma.1
`abrt-plugin-machine-id` AlmaLinux:8 From an advisory covering 4 CVEs	before 2.10.9-26.el8_10.alma.1	2.10.9-26.el8_10.alma.1
`abrt-plugin-sosreport` AlmaLinux:8 From an advisory covering 4 CVEs	before 2.10.9-26.el8_10.alma.1	2.10.9-26.el8_10.alma.1
`abrt-tui` AlmaLinux:8 From an advisory covering 4 CVEs	before 2.10.9-26.el8_10.alma.1	2.10.9-26.el8_10.alma.1
`python3-abrt` AlmaLinux:8 From an advisory covering 4 CVEs	before 2.10.9-26.el8_10.alma.1	2.10.9-26.el8_10.alma.1
`python3-abrt-addon` AlmaLinux:8 From an advisory covering 4 CVEs	before 2.10.9-26.el8_10.alma.1	2.10.9-26.el8_10.alma.1
`python3-abrt-container-addon` AlmaLinux:8 From an advisory covering 4 CVEs	before 2.10.9-26.el8_10.alma.1	2.10.9-26.el8_10.alma.1
`python3-abrt-doc` AlmaLinux:8 From an advisory covering 4 CVEs	before 2.10.9-26.el8_10.alma.1	2.10.9-26.el8_10.alma.1
`abrt-dbus` Red Hat:rhel_aus:8.6::appstream From an advisory covering 2 CVEs	before 0:2.10.9-25.el8_6.1	0:2.10.9-25.el8_6.1
`abrt-dbus` Red Hat:rhel_eus_long_life:8.6::appstream From an advisory covering 2 CVEs	before 0:2.10.9-25.el8_6.1	0:2.10.9-25.el8_6.1
`abrt-dbus` Red Hat:rhel_e4s:8.8::appstream From an advisory covering 2 CVEs	before 0:2.10.9-25.el8_8.1	0:2.10.9-25.el8_8.1
`abrt-dbus` Red Hat:rhel_tus:8.8::appstream From an advisory covering 2 CVEs	before 0:2.10.9-25.el8_8.1	0:2.10.9-25.el8_8.1
`abrt-dbus` Red Hat:rhel_aus:8.4::appstream From an advisory covering 2 CVEs	before 0:2.10.9-25.el8_4.1	0:2.10.9-25.el8_4.1
`abrt-dbus` Red Hat:rhel_eus_long_life:8.4::appstream From an advisory covering 2 CVEs	before 0:2.10.9-25.el8_4.1	0:2.10.9-25.el8_4.1
`abrt-dbus` Red Hat:rhel_els:7 From an advisory covering 2 CVEs	before 0:2.1.11-61.el7_9	0:2.1.11-61.el7_9
`abrt` Red Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs	before 0:2.10.9-26.el8_10	0:2.10.9-26.el8_10
`abrt-addon-ccpp` Red Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs	before 0:2.10.9-26.el8_10	0:2.10.9-26.el8_10
`abrt-addon-ccpp-debuginfo` Red Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs	before 0:2.10.9-26.el8_10	0:2.10.9-26.el8_10
`abrt-addon-coredump-helper` Red Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs	before 0:2.10.9-26.el8_10	0:2.10.9-26.el8_10
`abrt-addon-coredump-helper-debuginfo` Red Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs	before 0:2.10.9-26.el8_10	0:2.10.9-26.el8_10
`abrt-addon-kerneloops` Red Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs	before 0:2.10.9-26.el8_10	0:2.10.9-26.el8_10
`abrt-addon-kerneloops-debuginfo` Red Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs	before 0:2.10.9-26.el8_10	0:2.10.9-26.el8_10
`abrt-addon-pstoreoops` Red Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs	before 0:2.10.9-26.el8_10	0:2.10.9-26.el8_10
`abrt-addon-pstoreoops-debuginfo` Red Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs	before 0:2.10.9-26.el8_10	0:2.10.9-26.el8_10
`abrt-addon-upload-watch-debuginfo` Red Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs	before 0:2.10.9-26.el8_10	0:2.10.9-26.el8_10
`abrt-addon-vmcore` Red Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs	before 0:2.10.9-26.el8_10	0:2.10.9-26.el8_10
`abrt-addon-xorg` Red Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs	before 0:2.10.9-26.el8_10	0:2.10.9-26.el8_10
`abrt-addon-xorg-debuginfo` Red Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs	before 0:2.10.9-26.el8_10	0:2.10.9-26.el8_10
`abrt-atomic-debuginfo` Red Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs	before 0:2.10.9-26.el8_10	0:2.10.9-26.el8_10
`abrt-cli` Red Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs	before 0:2.10.9-26.el8_10	0:2.10.9-26.el8_10
`abrt-cli-ng` Red Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs	before 0:2.10.9-26.el8_10	0:2.10.9-26.el8_10
`abrt-console-notification` Red Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs	before 0:2.10.9-26.el8_10	0:2.10.9-26.el8_10
`abrt-dbus` Red Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs	before 0:2.10.9-26.el8_10	0:2.10.9-26.el8_10
`abrt-dbus-debuginfo` Red Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs	before 0:2.10.9-26.el8_10	0:2.10.9-26.el8_10
`abrt-debuginfo` Red Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs	before 0:2.10.9-26.el8_10	0:2.10.9-26.el8_10
`abrt-debugsource` Red Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs	before 0:2.10.9-26.el8_10	0:2.10.9-26.el8_10
`abrt-desktop` Red Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs	before 0:2.10.9-26.el8_10	0:2.10.9-26.el8_10
`abrt-gui` Red Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs	before 0:2.10.9-26.el8_10	0:2.10.9-26.el8_10
`abrt-gui-debuginfo` Red Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs	before 0:2.10.9-26.el8_10	0:2.10.9-26.el8_10
`abrt-gui-libs` Red Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs	before 0:2.10.9-26.el8_10	0:2.10.9-26.el8_10
`abrt-gui-libs-debuginfo` Red Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs	before 0:2.10.9-26.el8_10	0:2.10.9-26.el8_10
`abrt-libs` Red Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs	before 0:2.10.9-26.el8_10	0:2.10.9-26.el8_10
`abrt-libs-debuginfo` Red Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs	before 0:2.10.9-26.el8_10	0:2.10.9-26.el8_10
`abrt-plugin-machine-id` Red Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs	before 0:2.10.9-26.el8_10	0:2.10.9-26.el8_10
`abrt-plugin-sosreport` Red Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs	before 0:2.10.9-26.el8_10	0:2.10.9-26.el8_10
`abrt-retrace-client-debuginfo` Red Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs	before 0:2.10.9-26.el8_10	0:2.10.9-26.el8_10
`abrt-tui` Red Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs	before 0:2.10.9-26.el8_10	0:2.10.9-26.el8_10
`abrt-tui-debuginfo` Red Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs	before 0:2.10.9-26.el8_10	0:2.10.9-26.el8_10
`python3-abrt` Red Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs	before 0:2.10.9-26.el8_10	0:2.10.9-26.el8_10
`python3-abrt-addon` Red Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs	before 0:2.10.9-26.el8_10	0:2.10.9-26.el8_10
`python3-abrt-container-addon` Red Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs	before 0:2.10.9-26.el8_10	0:2.10.9-26.el8_10
`python3-abrt-debuginfo` Red Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs	before 0:2.10.9-26.el8_10	0:2.10.9-26.el8_10
`python3-abrt-doc` Red Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs	before 0:2.10.9-26.el8_10	0:2.10.9-26.el8_10
`abrt` Rocky Linux:8 From an advisory covering 4 CVEs	before 0:2.10.9-26.el8_10.rocky.0.1	0:2.10.9-26.el8_10.rocky.0.1

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts	EUVD, NVD
Nov 4, 2026	facts	CVE List
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-54229 is a high vulnerability (CVSS 7.0) in Red Hat Enterprise Linux 6, published June 13, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.12%, the 2nd percentile. No source names a fixed version.

References

Show 29 moreShow less