CVE-2026-54229
HighCVSS 7.0Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
A race condition was found in the abrt-dbus D-Bus service's ChownProblemDir method. It opens the dump directory with read-only access and changes file ownership to the caller's UID, even while post-create event handlers hold a write lock.
Risk Assessment
An attacker can gain filesystem-level control of the dump directory while privileged event scripts are still running, potentially leading to privilege escalation or data integrity compromise.
Recommendation
Immediately update the abrt package to a version that fixes this vulnerability, and consider restricting access to the abrt-dbus D-Bus service for unprivileged users.
Original NVD description (English source)
A race condition was found in the abrt-dbus D-Bus service's ChownProblemDir method. ChownProblemDir opens the dump directory with DD_OPEN_READONLY and calls dd_chown to change ownership of all files to the caller's uid, succeeding even while post-create event handlers hold a write lock. This allows an attacker to gain filesystem-level control of the dump directory while privileged event scripts are still running.