Quick answers
- Is CVE-2026-54229 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-54229 being exploited in the wild.
- How severe is CVE-2026-54229?
- High severity, with a CVSS score of 7, published 13 June 2026.
- Which products and versions are affected?
- Red Hat Abrt unspecified.
- Is there a fix for CVE-2026-54229?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-54229 attacked?
- It is attacked with local access, in an operating system.
- Am I affected by CVE-2026-54229?
- Check whether you run Red Hat Abrt at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A race condition (CWE-362) exists in the abrt-dbus D-Bus service's ChownProblemDir method. The vulnerability stems from ChownProblemDir opening dump directories using the DD_OPEN_READONLY flag, which fails to respect existing write locks held by post-create event handlers. By invoking this method, a local attacker can trigger dd_chown to change ownership of the directory's contents to their own UID. This allows the attacker to manipulate files (such as creating symlinks or deleting data) within the directory while privileged event shell processes are still running under the root-privileged abrt_handle_event_t SELinux domain. Exploitation requires local access and precise timing to interact with the D-Bus service during active event processing.
Affected products
- Red Hat abrt-dbus unspecified
Timeline
- 2026-06-12: disclosed: Reported via Red Hat Bugzilla
- 2026-06-13: advisory: NVD publication date