Race Condition Vulnerability in abrt-dbus ChownProblemDir Method Affecting Red Hat
CVE-2026-54229

7HIGH

Key Information:

Vendor

Red Hat
Status
Red Hat Enterprise Linux 7 Extended Lifecycle Support
Red Hat Enterprise Linux 8
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
Red Hat Enterprise Linux 8.4 Extended Update Support Long-life Add-on
Vendor
CVE Published:
13 June 2026

What is CVE-2026-54229?

A race condition vulnerability exists in the abrt-dbus D-Bus service's ChownProblemDir method. This vulnerability allows an attacker to manipulate filesystem ownership of the dump directory while privileged event scripts are still executing. By exploiting this flaw, unauthorized users could potentially gain control over sensitive files, as the method incorrectly handles file ownership when certain write locks are active. The flaw highlights potential risks in concurrent operations within the service and requires immediate attention to prevent misuse.

Affected Version(s)

Red Hat Enterprise Linux 7 Extended Lifecycle Support 0:2.1.11-61.el7_9

Red Hat Enterprise Linux 8 0:2.10.9-26.el8_10

Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support 0:2.10.9-25.el8_4.1

References

https://access.redhat.com/errata/RHSA-2026:48819
vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:48864
vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:48865
vendor-advisoryx_refsource_REDHAT

CVSS V3.1

Score:
7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Red Hat would like to thank Red Team (Deutsche Telekom Security GmbH) for reporting this issue.
.