CVE-2026-54228 — Abrt: toctou race condition in abrt-dbus setelement allows arbitrary file writes to dump directories
A time-of-check time-of-use (TOCTOU) race condition was found in the abrt-dbus D-Bus service's SetElement method. Between dump directory creation and post-create event execution…
Published: 2026-06-13 · CVSS: 7.8 · CVSS 3.1
A time-of-check time-of-use (TOCTOU) race condition was found in the abrt-dbus D-Bus service's SetElement method. Between dump directory creation and post-create event execution, any local user can call SetElement to write arbitrary text files into the root-owned dump directory, bypassing package validation and allowing crashes of unpackaged binaries to survive post-create processing.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7