# CVE-2026-88924: gvfs: A flaw was found in the admin backend of gvfs

CVE-2026-88924 is fixed in 22 products on 1 platform, first by gvfs 1.60.0-1ubuntu0.1, released September 10, 2026. It is not reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/cve/CVE-2026-88924
- Priority: High
- CVSS: 8.8 (high)
- EPSS: 0.0022
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Sep 9, 2026

## Description

A flaw was found in the admin backend of gvfs. The privileged gvfsd-admin daemon changes the ownership of newly created private D-Bus sockets by calling the link-following chown() function on a pathname inside a user-controlled directory. A local attacker can exploit this via a Time-of-Check Time-of-Use (TOCTOU) race condition and exchange the socket pathname with a symbolic link pointing to an arbitrary root-owned file (such as /etc/pam.d/su). The daemon subsequently follows the symlink and changes the ownership of the targeted root-owned file to the attacker's user ID. This allows an authenticated local attacker to modify critical system files, leading to a full local privilege escalation to root.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | gvfs Debian 14 | 1.62.0-1 | [DEBIAN-CVE-2026-88924](https://patchblox.com/security/data/fix/linux/debian-cve-2026-88924.md) | Sep 17, 2026 |
| Linux | gvfs RHEL 10 | 1.54.4-2.el10_0.2 | [RHSA-2026:85941](https://patchblox.com/security/data/fix/linux/rhsa-2026-85941.md) | Oct 1, 2026 |
| Linux | gvfs RHEL 9 | 0:1.48.1-8.el9_8.1 | [RHSA-2026:74370](https://patchblox.com/security/data/fix/linux/rhsa-2026-74370.md) | Oct 2, 2026 |
| Linux | gvfs Ubuntu 22.04.1 LTS (jammy) | 1.48.2-0ubuntu1.2 | [gvfs 1.48.2-0ubuntu1.2](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-gvfs-1.48.2-0ubuntu1.2.md) | Oct 1, 2026 |
| Linux | gvfs Ubuntu 24.04.5 LTS (noble) | 1.54.4-0ubuntu1~24.04.4 | [gvfs 1.54.4-0ubuntu1~24.04.4](https://patchblox.com/security/data/fix/linux/ubuntu-noble-gvfs-1.54.4-0ubuntu1-24.04.4.md) | Oct 1, 2026 |
| Linux | gvfs Ubuntu 26.04.1 LTS (resolute) | 1.60.0-1ubuntu0.1 | [gvfs 1.60.0-1ubuntu0.1](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-gvfs-1.60.0-1ubuntu0.1.md) | Sep 10, 2026 |
| Linux | gvfs almalinux 10 | 1.54.4-4.el10_2.1 | [ALSA-2026:73998](https://patchblox.com/security/data/fix/linux/alsa-2026-73998.md) | Sep 30, 2026 |
| Linux | gvfs almalinux 9 | 1.48.1-8.el9_8.1 | [ALSA-2026:74370](https://patchblox.com/security/data/fix/linux/alsa-2026-74370.md) | Oct 1, 2026 |
| Linux | gvfs amzn 2023 | 1.56.1-1.amzn2023.0.3 | [ALAS2023-2026-3120](https://patchblox.com/security/data/fix/linux/alas2023-2026-3120.md) | Sep 28, 2026 |
| Linux | gvfs ol 10 | 0:1.54.4-4.el10_2.1 | [ELSA-2026-73998](https://patchblox.com/security/data/fix/linux/elsa-2026-73998.md) | Oct 1, 2026 |
| Linux | gvfs ol 9 | 0:1.48.1-8.el9_8.1 | [ELSA-2026-74370](https://patchblox.com/security/data/fix/linux/elsa-2026-74370.md) | Oct 1, 2026 |
| Linux | gvfs opensuse-leap 16.0 | 1.59.90-160000.4.1 | [OPENSUSE-SU-2026:22174-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-22174-1.md) | Nov 7, 2026 |
| Linux | gvfs rocky 10 | 0:1.54.4-4.el10_2.1 | [RLSA-2026:73998](https://patchblox.com/security/data/fix/linux/rlsa-2026-73998.md) | Oct 1, 2026 |
| Linux | gvfs rocky 9 | 0:1.48.1-8.el9_8.1 | [RLSA-2026:74370](https://patchblox.com/security/data/fix/linux/rlsa-2026-74370.md) | Oct 2, 2026 |
| Linux | gvfs sles 15.6 | 1.52.2-150600.3.12.1 | [SUSE-SU-2026:5065-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-5065-1.md) | Nov 7, 2026 |
| Linux | gvfs sles 15.7 | 1.52.2-150600.3.12.1 | [SUSE-SU-2026:5065-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-5065-1.md) | Nov 7, 2026 |
| Linux | gvfs sles 16.0 | 1.59.90-160000.4.1 | [SUSE-SU-2026:24466-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-24466-1.md) | Nov 7, 2026 |
| Linux | gvfs-archive amzn 2023 | 1.56.1-1.amzn2023.0.3 | [ALAS2023-2026-3120](https://patchblox.com/security/data/fix/linux/alas2023-2026-3120.md) | Sep 28, 2026 |
| Linux | gvfs-archive-debuginfo amzn 2023 | 1.56.1-1.amzn2023.0.3 | [ALAS2023-2026-3120](https://patchblox.com/security/data/fix/linux/alas2023-2026-3120.md) | Sep 28, 2026 |
| Linux | gvfs-backends Ubuntu 22.04.1 LTS (jammy) | 1.48.2-0ubuntu1.2 | [gvfs-backends 1.48.2-0ubuntu1.2](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-gvfs-backends-1.48.2-0ubuntu1.2.md) | Oct 1, 2026 |
| Linux | gvfs-backends Ubuntu 24.04.5 LTS (noble) | 1.54.4-0ubuntu1~24.04.4 | [gvfs-backends 1.54.4-0ubuntu1~24.04.4](https://patchblox.com/security/data/fix/linux/ubuntu-noble-gvfs-backends-1.54.4-0ubuntu1-24.04.4.md) | Oct 1, 2026 |
| Linux | gvfs-backends Ubuntu 26.04.1 LTS (resolute) | 1.60.0-1ubuntu0.1 | [gvfs-backends 1.60.0-1ubuntu0.1](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-gvfs-backends-1.60.0-1ubuntu0.1.md) | Sep 10, 2026 |
| Linux | gvfs-client RHEL 9 | 0:1.48.1-8.el9_8.1 | [RHSA-2026:74370](https://patchblox.com/security/data/fix/linux/rhsa-2026-74370.md) | Oct 2, 2026 |
| Linux | gvfs-client almalinux 10 | 1.54.4-4.el10_2.1 | [ALSA-2026:73998](https://patchblox.com/security/data/fix/linux/alsa-2026-73998.md) | Sep 30, 2026 |
| Linux | gvfs-client almalinux 9 | 1.48.1-8.el9_8.1 | [ALSA-2026:74370](https://patchblox.com/security/data/fix/linux/alsa-2026-74370.md) | Oct 1, 2026 |
| Linux | gvfs-client amzn 2023 | 1.56.1-1.amzn2023.0.3 | [ALAS2023-2026-3120](https://patchblox.com/security/data/fix/linux/alas2023-2026-3120.md) | Sep 28, 2026 |
| Linux | gvfs-client ol 10 | 0:1.54.4-4.el10_2.1 | [ELSA-2026-73998](https://patchblox.com/security/data/fix/linux/elsa-2026-73998.md) | Oct 1, 2026 |
| Linux | gvfs-client ol 9 | 0:1.48.1-8.el9_8.1 | [ELSA-2026-74370](https://patchblox.com/security/data/fix/linux/elsa-2026-74370.md) | Oct 1, 2026 |
| Linux | gvfs-client-debuginfo amzn 2023 | 1.56.1-1.amzn2023.0.3 | [ALAS2023-2026-3120](https://patchblox.com/security/data/fix/linux/alas2023-2026-3120.md) | Sep 28, 2026 |
| Linux | gvfs-common Ubuntu 22.04.1 LTS (jammy) | 1.48.2-0ubuntu1.2 | [gvfs-common 1.48.2-0ubuntu1.2](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-gvfs-common-1.48.2-0ubuntu1.2.md) | Oct 1, 2026 |
| Linux | gvfs-common Ubuntu 24.04.5 LTS (noble) | 1.54.4-0ubuntu1~24.04.4 | [gvfs-common 1.54.4-0ubuntu1~24.04.4](https://patchblox.com/security/data/fix/linux/ubuntu-noble-gvfs-common-1.54.4-0ubuntu1-24.04.4.md) | Oct 1, 2026 |
| Linux | gvfs-common Ubuntu 26.04.1 LTS (resolute) | 1.60.0-1ubuntu0.1 | [gvfs-common 1.60.0-1ubuntu0.1](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-gvfs-common-1.60.0-1ubuntu0.1.md) | Sep 10, 2026 |
| Linux | gvfs-daemons Ubuntu 22.04.1 LTS (jammy) | 1.48.2-0ubuntu1.2 | [gvfs-daemons 1.48.2-0ubuntu1.2](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-gvfs-daemons-1.48.2-0ubuntu1.2.md) | Oct 1, 2026 |
| Linux | gvfs-daemons Ubuntu 24.04.5 LTS (noble) | 1.54.4-0ubuntu1~24.04.4 | [gvfs-daemons 1.54.4-0ubuntu1~24.04.4](https://patchblox.com/security/data/fix/linux/ubuntu-noble-gvfs-daemons-1.54.4-0ubuntu1-24.04.4.md) | Oct 1, 2026 |
| Linux | gvfs-daemons Ubuntu 26.04.1 LTS (resolute) | 1.60.0-1ubuntu0.1 | [gvfs-daemons 1.60.0-1ubuntu0.1](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-gvfs-daemons-1.60.0-1ubuntu0.1.md) | Sep 10, 2026 |
| Linux | gvfs-debuginfo amzn 2023 | 1.56.1-1.amzn2023.0.3 | [ALAS2023-2026-3120](https://patchblox.com/security/data/fix/linux/alas2023-2026-3120.md) | Sep 28, 2026 |
| Linux | gvfs-debugsource amzn 2023 | 1.56.1-1.amzn2023.0.3 | [ALAS2023-2026-3120](https://patchblox.com/security/data/fix/linux/alas2023-2026-3120.md) | Sep 28, 2026 |
| Linux | gvfs-devel RHEL 9 | 0:1.48.1-8.el9_8.1 | [RHSA-2026:74370](https://patchblox.com/security/data/fix/linux/rhsa-2026-74370.md) | Oct 2, 2026 |
| Linux | gvfs-devel almalinux 9 | 1.48.1-8.el9_8.1 | [ALSA-2026:74370](https://patchblox.com/security/data/fix/linux/alsa-2026-74370.md) | Oct 1, 2026 |
| Linux | gvfs-devel ol 9 | 0:1.48.1-8.el9_8.1 | [ELSA-2026-74370](https://patchblox.com/security/data/fix/linux/elsa-2026-74370.md) | Oct 1, 2026 |
| Linux | gvfs-fuse RHEL 9 | 0:1.48.1-8.el9_8.1 | [RHSA-2026:74370](https://patchblox.com/security/data/fix/linux/rhsa-2026-74370.md) | Oct 2, 2026 |
| Linux | gvfs-fuse Ubuntu 22.04.1 LTS (jammy) | 1.48.2-0ubuntu1.2 | [gvfs-fuse 1.48.2-0ubuntu1.2](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-gvfs-fuse-1.48.2-0ubuntu1.2.md) | Oct 1, 2026 |
| Linux | gvfs-fuse Ubuntu 24.04.5 LTS (noble) | 1.54.4-0ubuntu1~24.04.4 | [gvfs-fuse 1.54.4-0ubuntu1~24.04.4](https://patchblox.com/security/data/fix/linux/ubuntu-noble-gvfs-fuse-1.54.4-0ubuntu1-24.04.4.md) | Oct 1, 2026 |
| Linux | gvfs-fuse Ubuntu 26.04.1 LTS (resolute) | 1.60.0-1ubuntu0.1 | [gvfs-fuse 1.60.0-1ubuntu0.1](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-gvfs-fuse-1.60.0-1ubuntu0.1.md) | Sep 10, 2026 |
| Linux | gvfs-fuse almalinux 10 | 1.54.4-4.el10_2.1 | [ALSA-2026:73998](https://patchblox.com/security/data/fix/linux/alsa-2026-73998.md) | Sep 30, 2026 |
| Linux | gvfs-fuse almalinux 9 | 1.48.1-8.el9_8.1 | [ALSA-2026:74370](https://patchblox.com/security/data/fix/linux/alsa-2026-74370.md) | Oct 1, 2026 |
| Linux | gvfs-fuse amzn 2023 | 1.56.1-1.amzn2023.0.3 | [ALAS2023-2026-3120](https://patchblox.com/security/data/fix/linux/alas2023-2026-3120.md) | Sep 28, 2026 |
| Linux | gvfs-fuse ol 10 | 0:1.54.4-4.el10_2.1 | [ELSA-2026-73998](https://patchblox.com/security/data/fix/linux/elsa-2026-73998.md) | Oct 1, 2026 |
| Linux | gvfs-fuse ol 9 | 0:1.48.1-8.el9_8.1 | [ELSA-2026-74370](https://patchblox.com/security/data/fix/linux/elsa-2026-74370.md) | Oct 1, 2026 |
| Linux | gvfs-fuse-debuginfo amzn 2023 | 1.56.1-1.amzn2023.0.3 | [ALAS2023-2026-3120](https://patchblox.com/security/data/fix/linux/alas2023-2026-3120.md) | Sep 28, 2026 |
| Linux | gvfs-goa RHEL 9 | 0:1.48.1-8.el9_8.1 | [RHSA-2026:74370](https://patchblox.com/security/data/fix/linux/rhsa-2026-74370.md) | Oct 2, 2026 |
| Linux | gvfs-goa almalinux 10 | 1.54.4-4.el10_2.1 | [ALSA-2026:73998](https://patchblox.com/security/data/fix/linux/alsa-2026-73998.md) | Sep 30, 2026 |
| Linux | gvfs-goa almalinux 9 | 1.48.1-8.el9_8.1 | [ALSA-2026:74370](https://patchblox.com/security/data/fix/linux/alsa-2026-74370.md) | Oct 1, 2026 |
| Linux | gvfs-goa amzn 2023 | 1.56.1-1.amzn2023.0.3 | [ALAS2023-2026-3120](https://patchblox.com/security/data/fix/linux/alas2023-2026-3120.md) | Sep 28, 2026 |
| Linux | gvfs-goa ol 10 | 0:1.54.4-4.el10_2.1 | [ELSA-2026-73998](https://patchblox.com/security/data/fix/linux/elsa-2026-73998.md) | Oct 1, 2026 |
| Linux | gvfs-goa ol 9 | 0:1.48.1-8.el9_8.1 | [ELSA-2026-74370](https://patchblox.com/security/data/fix/linux/elsa-2026-74370.md) | Oct 1, 2026 |
| Linux | gvfs-goa-debuginfo amzn 2023 | 1.56.1-1.amzn2023.0.3 | [ALAS2023-2026-3120](https://patchblox.com/security/data/fix/linux/alas2023-2026-3120.md) | Sep 28, 2026 |
| Linux | gvfs-gphoto2 RHEL 9 | 0:1.48.1-8.el9_8.1 | [RHSA-2026:74370](https://patchblox.com/security/data/fix/linux/rhsa-2026-74370.md) | Oct 2, 2026 |
| Linux | gvfs-gphoto2 almalinux 10 | 1.54.4-4.el10_2.1 | [ALSA-2026:73998](https://patchblox.com/security/data/fix/linux/alsa-2026-73998.md) | Sep 30, 2026 |
| Linux | gvfs-gphoto2 almalinux 9 | 1.48.1-8.el9_8.1 | [ALSA-2026:74370](https://patchblox.com/security/data/fix/linux/alsa-2026-74370.md) | Oct 1, 2026 |
| Linux | gvfs-gphoto2 ol 10 | 0:1.54.4-4.el10_2.1 | [ELSA-2026-73998](https://patchblox.com/security/data/fix/linux/elsa-2026-73998.md) | Oct 1, 2026 |
| Linux | gvfs-gphoto2 ol 9 | 0:1.48.1-8.el9_8.1 | [ELSA-2026-74370](https://patchblox.com/security/data/fix/linux/elsa-2026-74370.md) | Oct 1, 2026 |
| Linux | gvfs-libs Ubuntu 22.04.1 LTS (jammy) | 1.48.2-0ubuntu1.2 | [gvfs-libs 1.48.2-0ubuntu1.2](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-gvfs-libs-1.48.2-0ubuntu1.2.md) | Oct 1, 2026 |
| Linux | gvfs-libs Ubuntu 24.04.5 LTS (noble) | 1.54.4-0ubuntu1~24.04.4 | [gvfs-libs 1.54.4-0ubuntu1~24.04.4](https://patchblox.com/security/data/fix/linux/ubuntu-noble-gvfs-libs-1.54.4-0ubuntu1-24.04.4.md) | Oct 1, 2026 |
| Linux | gvfs-libs Ubuntu 26.04.1 LTS (resolute) | 1.60.0-1ubuntu0.1 | [gvfs-libs 1.60.0-1ubuntu0.1](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-gvfs-libs-1.60.0-1ubuntu0.1.md) | Sep 10, 2026 |
| Linux | gvfs-mtp RHEL 9 | 0:1.48.1-8.el9_8.1 | [RHSA-2026:74370](https://patchblox.com/security/data/fix/linux/rhsa-2026-74370.md) | Oct 2, 2026 |
| Linux | gvfs-mtp almalinux 10 | 1.54.4-4.el10_2.1 | [ALSA-2026:73998](https://patchblox.com/security/data/fix/linux/alsa-2026-73998.md) | Sep 30, 2026 |
| Linux | gvfs-mtp almalinux 9 | 1.48.1-8.el9_8.1 | [ALSA-2026:74370](https://patchblox.com/security/data/fix/linux/alsa-2026-74370.md) | Oct 1, 2026 |
| Linux | gvfs-mtp ol 10 | 0:1.54.4-4.el10_2.1 | [ELSA-2026-73998](https://patchblox.com/security/data/fix/linux/elsa-2026-73998.md) | Oct 1, 2026 |
| Linux | gvfs-mtp ol 9 | 0:1.48.1-8.el9_8.1 | [ELSA-2026-74370](https://patchblox.com/security/data/fix/linux/elsa-2026-74370.md) | Oct 1, 2026 |
| Linux | gvfs-nfs amzn 2023 | 1.56.1-1.amzn2023.0.3 | [ALAS2023-2026-3120](https://patchblox.com/security/data/fix/linux/alas2023-2026-3120.md) | Sep 28, 2026 |
| Linux | gvfs-nfs-debuginfo amzn 2023 | 1.56.1-1.amzn2023.0.3 | [ALAS2023-2026-3120](https://patchblox.com/security/data/fix/linux/alas2023-2026-3120.md) | Sep 28, 2026 |
| Linux | gvfs-smb RHEL 9 | 0:1.48.1-8.el9_8.1 | [RHSA-2026:74370](https://patchblox.com/security/data/fix/linux/rhsa-2026-74370.md) | Oct 2, 2026 |
| Linux | gvfs-smb almalinux 10 | 1.54.4-4.el10_2.1 | [ALSA-2026:73998](https://patchblox.com/security/data/fix/linux/alsa-2026-73998.md) | Sep 30, 2026 |
| Linux | gvfs-smb almalinux 9 | 1.48.1-8.el9_8.1 | [ALSA-2026:74370](https://patchblox.com/security/data/fix/linux/alsa-2026-74370.md) | Oct 1, 2026 |
| Linux | gvfs-smb amzn 2023 | 1.56.1-1.amzn2023.0.3 | [ALAS2023-2026-3120](https://patchblox.com/security/data/fix/linux/alas2023-2026-3120.md) | Sep 28, 2026 |
| Linux | gvfs-smb ol 10 | 0:1.54.4-4.el10_2.1 | [ELSA-2026-73998](https://patchblox.com/security/data/fix/linux/elsa-2026-73998.md) | Oct 1, 2026 |
| Linux | gvfs-smb ol 9 | 0:1.48.1-8.el9_8.1 | [ELSA-2026-74370](https://patchblox.com/security/data/fix/linux/elsa-2026-74370.md) | Oct 1, 2026 |
| Linux | gvfs-smb-debuginfo amzn 2023 | 1.56.1-1.amzn2023.0.3 | [ALAS2023-2026-3120](https://patchblox.com/security/data/fix/linux/alas2023-2026-3120.md) | Sep 28, 2026 |

---

Data as of 2026-11-08T13:06:02Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.