# CVE-2026-54228: Red Hat abrt TOCTOU race condition in abrt-dbus SetElement

Source: https://junglewise.ai/threats/cve-2026-54228-red-hat-abrt-toctou-race-condition-in-abrt-dbus-setelement  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-13. Updated: 2026-06-13  
License: CC BY 4.0 with a link back

CVE-2026-54228 · Severity: high · CVSS 7.8 · Published 2026-06-13

A security vulnerability has been identified in the Automatic Bug Reporting Tool (ABRT), a service used in Linux environments to collect and analyze software crash data. A local user can exploit a timing flaw to inject unauthorized data into system crash reports before they are processed by the system. This could allow an attacker to bypass security validations, potentially leading to unauthorized file modifications or the ability to hide malicious activity within system logs.

Technologies: [Red Hat Abrt](https://junglewise.ai/threats/technologies/abrt). Vendors: [Red Hat](https://junglewise.ai/threats/vendors/red-hat).

## Quick answers

**Is CVE-2026-54228 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-54228 being exploited in the wild.

**How severe is CVE-2026-54228?** High severity, with a CVSS score of 7.8, published 13 June 2026.

**Which products and versions are affected?** Red Hat Abrt unspecified.

**Is there a fix for CVE-2026-54228?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-54228 attacked?** It is attacked with local access, in an operating system.

**Am I affected by CVE-2026-54228?** Check whether you run Red Hat Abrt at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A TOCTOU race condition exists in the abrt-dbus D-Bus service's SetElement method. The vulnerability occurs in the window between the creation of a dump directory by abrtd and the execution of post-create events. During this interval, a local user can invoke SetElement to write arbitrary text files into the root-owned dump directory. The service's access check (dd_accessible_by_uid) relies on a UID element within the directory that matches the caller's UID if they triggered the initial crash. By exploiting this race, an attacker can modify elements like 'component' to bypass package validation (abrt-action-save-package-data), ensuring that crashes from unpackaged or malicious binaries persist through post-create processing.

## Affected products

- Red Hat abrt unspecified

## Timeline

- 2026-06-12: disclosed: Initial report via Red Hat Bugzilla
- 2026-06-13: advisory: NVD publication date

## References

- [https://access.redhat.com/security/cve/CVE-2026-54228](https://access.redhat.com/security/cve/CVE-2026-54228)
- [https://bugzilla.redhat.com/show_bug.cgi?id=2488531](https://bugzilla.redhat.com/show_bug.cgi?id=2488531)

## Related threats

- [Red Hat libreport content injection in ABRT post-create scripts](https://junglewise.ai/threats/cve-2026-54231-red-hat-libreport-content-injection-in-abrt-post-create-scripts)
- [Red Hat libreport symlink following in ABRT event handler scripts](https://junglewise.ai/threats/cve-2026-54230-red-hat-libreport-symlink-following-in-abrt-event-handler-scripts)
- [Red Hat abrt race condition in ChownProblemDir method](https://junglewise.ai/threats/cve-2026-54229-red-hat-abrt-race-condition-in-chownproblemdir-method)