CVE-2026-54229: abrt-dbus Race Condition Vulnerability

CVE-2026-54229 Overview

CVE-2026-54229 is a race condition vulnerability in the abrt-dbus D-Bus service, specifically in the ChownProblemDir method. The method opens the dump directory with DD_OPEN_READONLY and invokes dd_chown to transfer ownership of all files to the caller's UID. This operation succeeds even while post-create event handlers still hold a write lock on the directory. A local authenticated attacker can exploit this timing window to gain filesystem-level control of a dump directory while privileged event scripts continue executing against it.

Critical Impact
Local attackers can hijack ownership of dump directories during privileged ABRT post-create event processing, leading to integrity and confidentiality compromise of files written by elevated scripts.

Affected Products

ABRT (Automatic Bug Reporting Tool) — abrt-dbus component
Red Hat Enterprise Linux distributions shipping the affected abrt-dbus build
Downstream Linux distributions packaging the vulnerable ABRT release

Discovery Timeline

2026-06-13 - CVE-2026-54229 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-54229

Vulnerability Analysis

The flaw is a classic Time-of-Check Time-of-Use (TOCTOU) race condition tracked under [CWE-362]. The abrt-dbus service exposes the ChownProblemDir D-Bus method to allow callers to take ownership of their problem dump directories. The method opens the target directory in read-only mode using DD_OPEN_READONLY and proceeds to call dd_chown, which recursively changes ownership of all files inside. Because the read-only open does not require nor honor the exclusive write lock held by ABRT post-create event handlers, the chown completes successfully while privileged event scripts are still writing data into the directory. The attacker therefore obtains UID ownership of files generated by elevated ABRT helpers, including any sensitive crash data or scripts those handlers produce after the race resolves.

Root Cause

The root cause is incorrect lock semantics. ChownProblemDir does not contend for the directory's write lock and treats a read-only open as sufficient to perform a privileged ownership transition. The serialization that normally protects in-flight post-create processing is bypassed, allowing two privilege domains to operate on the same directory concurrently.

Attack Vector

Exploitation requires local access and low privileges. The attacker triggers a crash or otherwise causes ABRT to create a problem directory, then races to invoke ChownProblemDir over D-Bus while ABRT's post-create event handlers are still executing. Successful exploitation grants the attacker ownership of files produced by the privileged handler chain, enabling tampering with crash artifacts, hooking subsequent reporting steps, or reading data the handler writes after the ownership transition.

No verified public proof-of-concept code is available. See the Red Hat CVE-2026-54229 Advisory and Red Hat Bug Report #2488532 for upstream technical details.

Detection Methods for CVE-2026-54229

Indicators of Compromise

Problem dump directories under /var/spool/abrt/ whose ownership UID does not match the abrt service account while post-create scripts are still running.
Unexpected org.freedesktop.problems.ChownProblemDir D-Bus method calls from unprivileged users immediately after crash events.
Auditd records showing chown activity on ABRT dump directories interleaved with writes from ABRT helper processes.

Detection Strategies

Monitor D-Bus traffic on the system bus for ChownProblemDir invocations and correlate timestamps with ABRT post-create event execution.
Alert on changes to file ownership inside /var/spool/abrt/ that occur during active ABRT event-handler PIDs.
Use auditd rules on the ABRT spool path to record chown, open, and write syscalls for forensic reconstruction.

Monitoring Recommendations

Enable Linux audit subsystem watches on /var/spool/abrt/ and the abrt-dbus binary path.
Forward abrt-dbus and abrtd journald logs to a central log platform for anomaly review.
Track process lineage for any unprivileged process invoking D-Bus methods on org.freedesktop.problems shortly after a crash dump is created.

How to Mitigate CVE-2026-54229

Immediate Actions Required

Apply vendor updates for the abrt and abrt-dbus packages as soon as fixed builds are available from your Linux distribution.
Restrict access to the org.freedesktop.problems D-Bus interface so that only trusted local accounts can invoke ChownProblemDir.
Audit existing ABRT spool directories for unexpected ownership changes and quarantine suspicious dumps.

Patch Information

At time of publication, fixes are being tracked through the Red Hat CVE-2026-54229 Advisory and Red Hat Bug Report #2488532. Install the patched abrt-dbus package from your distribution once published and restart the service to load the corrected lock handling.

Workarounds

Temporarily disable the abrt-dbus service on systems where local untrusted users may be present until a patched build is installed.
Tighten the D-Bus policy in /etc/dbus-1/system.d/ to deny ChownProblemDir calls from non-administrative users.
Disable ABRT post-create event handlers that run with elevated privileges if they are not required in your environment.

bash

# Configuration example: restrict ChownProblemDir via D-Bus policy
# /etc/dbus-1/system.d/abrt-restrict.conf
<busconfig>
  <policy context="default">
    <deny send_destination="org.freedesktop.problems"
          send_interface="org.freedesktop.problems"
          send_member="ChownProblemDir"/>
  </policy>
  <policy user="root">
    <allow send_destination="org.freedesktop.problems"
           send_interface="org.freedesktop.problems"
           send_member="ChownProblemDir"/>
  </policy>
</busconfig>

# Reload D-Bus configuration
sudo systemctl reload dbus