A security vulnerability ( #875 ) in the gvfsd-admin daemon that allows local privilege escalation was recently discovered and is tracked as CVE-2026-88924 .

What is the issue?

The problem relates to how the daemon creates a private D-Bus socket. Previously, the socket was created with root privileges, and then a chown() call was used to change its ownership to the invoking user. Because this happened inside a user-controlled directory, a local attacker could exploit a race condition by quickly replacing the newly created socket with a symlink pointing to a root-owned file (e.g., /etc/pam.d/su ). This would grant the attacker ownership of that critical file, leading to a local root privilege escalation.

Who is affected?

To exploit this vulnerability, an attacker needs local code execution within an active graphical session and must belong to a privileged desktop group (like wheel or sudo ). The gvfsd-admin backend must also be installed. Unfortunately, these conditions are met by default on many standard desktop installations.

What to do?

The fix is already merged ( !352 ). The issue was resolved by using setfsuid() to set the correct filesystem UID before the socket creation. New versions 1.62.0, 1.60.3, and 1.58.5 containing this fix have just been released. I strongly recommend all users and distribution maintainers to update as soon as possible.

Finally, I would like to thank the security researcher lain for discovering the vulnerability and providing a very detailed report!