---
id: "CVE-2026-110331"
page: "https://infrastack.ai/live/CVE-2026-110331"
kind: "vulnerability"
aliases: ["CVE-2026-110331"]
title: "abrt: local users can tamper with crash dump directories"
severity: "high"
cvss: 7.8
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "abrt", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["abrt", "linux", "other", "self-hosted"]
not_affected_if: ["abrt-not-installed", "no-local-untrusted-users"]
published_at: "2026-11-13T22:17:21+00:00"
first_seen_at: "2026-11-13T22:33:34+00:00"
updated_at: "2026-11-13T22:38:43+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110331", "first_seen_at": "2026-11-13T22:33:34+00:00"}, {"source": "analyst", "url": "https://access.redhat.com/security/cve/CVE-2026-110331", "first_seen_at": "2026-11-13T22:38:43+00:00", "cites": ["https://access.redhat.com/security/cve/CVE-2026-110331", "https://github.com/abrt/abrt/blob/master/CHANGELOG.md"]}]
exploit_sources: []
---

# abrt: local users can tamper with crash dump directories

Link for people: https://infrastack.ai/live/CVE-2026-110331 (this .md is for agents)

ABRT, the Linux crash-reporting tool, has a flaw where a completeness check on crash dump directories can be bypassed by an unprivileged local user. An attacker can then alter dump elements or take ownership of dump directories while privileged ABRT handlers process them.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:abrt affected range not listed fixed no fixed version listed

## How to check

- rpm -q abrt (or dpkg -l abrt): is ABRT installed, and which version. No fixed version is published yet.
- systemctl status abrtd abrt-journal-core abrt-oops abrt-xorg: see which services run.
- abrt-dbus is D-Bus activatable even when abrtd is stopped, so a stopped abrtd does not mean safe.
- Also check whether untrusted local users can log in.
- Workaround from Red Hat: systemctl disable --now abrtd.service abrt-journal-core.service abrt-oops.service abrt-xorg.service, or remove ABRT, and restrict local interactive access.

## Timeline

- 2026-11-13T22:33:34+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-110331
- 2026-11-13T22:38:43+00:00 analyst https://access.redhat.com/security/cve/CVE-2026-110331 — Red Hat CVE page read: no fixed version or affected range yet, only a mitigation (disable ABRT services). Upstream changelog lists the earlier fixes in 2.17.9, nothing for this CVE. No PoC or exploitation seen. Bugzilla 2552067. Nothing verified: no vendor fix statement. X not checked.

## Documents

- [advisory] Red Hat CVE-2026-110331 https://access.redhat.com/security/cve/CVE-2026-110331
- [mentions] abrt CHANGELOG https://github.com/abrt/abrt/blob/master/CHANGELOG.md

## From the sources

A flaw was found in abrt. The completeness check introduced to mitigate CVE-2026-54228 and CVE-2026-54229 only verifies that a dump directory contains a "count" element, which an unprivileged user can create. This allows a local attacker to bypass the guard and again poison elements in, or seize ownership of, dump directories while privileged ABRT handlers are processing them. Related Problems2 mutating methods remain ungated by the same check.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_