Name: CVE-2026-54228: Time-of-check Time-of-use (TOCTOU) Race Condition
Creator: Rapid7
Published: 2026-06-13T00:00:00.000Z
License: https://www.rapid7.com/legal/website-terms-of-use/
Keywords: CVE, CVE-2026-54228, CWE-367, CVSS 7.8, EPSS 0.00134

A time-of-check time-of-use (TOCTOU) race condition was found in the abrt-dbus D-Bus service's SetElement method. Between dump directory creation and post-create event execution, any local user can call SetElement to write arbitrary text files into the root-owned dump directory, bypassing package validation and allowing crashes of unpackaged binaries to survive post-create processing.

CVSS Details

CVSS 3.1 Base Score: 7.8
CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Covered by Rapid7

Product	Vendor Advisory	Solution File	Added	Published
Alma_linux	—	Upgrade abrt-dbusUpgrade abrt-plugin-sosreportUpgrade abrt-addon-coredump-helperUpgrade python3-abrtUpgrade abrt-gui-libsUpgrade python3-abrt-docUpgrade abrt-cliUpgrade abrtUpgrade abrt-plugin-machine-idUpgrade abrt-addon-kerneloopsUpgrade abrt-cli-ngUpgrade abrt-addon-vmcoreUpgrade abrt-addon-xorgUpgrade abrt-tuiUpgrade abrt-addon-pstoreoopsUpgrade abrt-libsUpgrade python3-abrt-addonUpgrade abrt-addon-ccppUpgrade python3-abrt-container-addonUpgrade abrt-guiUpgrade abrt-desktopUpgrade abrt-console-notification	Oct 11, 2026	Aug 12, 2026
Redhat_linux	—	Upgrade abrt-libs-debuginfoUpgrade abrt-tuiUpgrade abrt-addon-xorg-debuginfoUpgrade abrt-addon-kerneloops-debuginfoUpgrade abrt-console-notificationUpgrade python3-abrt-debuginfoUpgrade abrt-gui-debuginfoUpgrade abrt-retrace-clientUpgrade abrt-gui-develUpgrade abrt-retrace-client-debuginfoNo solution existsUpgrade abrt-debugsourceUpgrade abrt-atomic-debuginfoUpgrade abrt-addon-upload-watchUpgrade abrt-addon-pstoreoops-debuginfoUpgrade abrt-dbus-debuginfoUpgrade abrt-gui-libs-debuginfoUpgrade abrt-plugin-sosreportUpgrade abrt-addon-xorgUpgrade abrt-addon-pythonUpgrade python3-abrt-container-addonUpgrade abrt-dbusUpgrade abrt-addon-coredump-helperUpgrade abrt-plugin-machine-idUpgrade abrt-addon-vmcoreUpgrade python3-abrt-docUpgrade abrt-develUpgrade abrt-addon-upload-watch-debuginfoUpgrade abrt-addon-ccpp-debuginfoUpgrade abrt-addon-coredump-helper-debuginfoUpgrade abrtUpgrade abrt-cli-ngUpgrade abrt-addon-ccppUpgrade python3-abrtUpgrade abrt-python-docUpgrade abrt-tui-debuginfoUpgrade python3-abrt-addonUpgrade abrt-addon-kerneloopsUpgrade abrt-addon-pstoreoopsUpgrade abrt-pythonUpgrade abrt-cliUpgrade abrt-gui-libsUpgrade abrt-libsUpgrade abrt-guiUpgrade abrt-desktopUpgrade abrt-debuginfo	Jul 17, 2026	May 4, 2026
Rocky_linux	—	Upgrade abrt-gui-debuginfoUpgrade abrt-desktopUpgrade abrt-addon-ccpp-debuginfoUpgrade abrt-addon-xorg-debuginfoUpgrade abrt-console-notificationUpgrade python3-abrtUpgrade abrt-addon-kerneloops-debuginfoUpgrade abrt-dbus-debuginfoUpgrade abrt-tui-debuginfoUpgrade abrt-addon-pstoreoops-debuginfoUpgrade abrt-gui-libs-debuginfoUpgrade abrt-tuiUpgrade python3-abrt-addonUpgrade abrt-plugin-sosreportUpgrade abrt-addon-xorgUpgrade abrt-addon-vmcoreUpgrade abrt-debuginfoUpgrade abrt-libs-debuginfoUpgrade abrt-libsUpgrade abrt-cli-ngUpgrade abrt-addon-coredump-helperUpgrade abrt-addon-pstoreoopsUpgrade abrt-gui-libsUpgrade abrt-plugin-machine-idUpgrade python3-abrt-debuginfoUpgrade abrt-debugsourceUpgrade abrt-dbusUpgrade abrt-addon-coredump-helper-debuginfoUpgrade abrt-addon-kerneloopsUpgrade abrt-addon-ccppUpgrade abrtUpgrade abrt-cliUpgrade python3-abrt-container-addonUpgrade abrt-gui	Aug 14, 2026	Aug 13, 2026

Prioritise with Active Threat Intelligence

With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.

Explore Intelligence Hub

MDR Buyer's Guide

Global Threat Landscape Report

Grow your business

CVSS Details

Covered by Rapid7

Prioritise with Active Threat Intelligence